CVE-2026-42581 — Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Description (CNA)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected (CNA)

Vendor / product	Versions
netty / netty	affected >= 4.2.0.Alpha1, < 4.2.13.Final; affected < 4.1.133.Final

CWE

CWE-444

References

https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9

redhat-SADP

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.