CVE-2026-42578 — Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Description (CNA)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected (CNA)

Vendor / product	Versions
netty / netty	affected >= 4.2.0.Alpha1, < 4.2.13.Final; affected < 4.1.133.Final

CWE

CWE-113

References

https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr

redhat-SADP

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.