Netty: Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating… (CVE-2026-59921)

The vulnerability in Netty's HttpPostRequestEncoder affects versions prior to 4.1.136.Final and 4.2.16.Final. It arises because multipart HTTP request bodies are constructed by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without sanitizing carriage return and line feed (CRLF) characters. This lack of sanitization enables an attacker who can control the filename to inject arbitrary MIME headers into the multipart body part. The vulnerability is identified as CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers). The issue has been fixed in Netty versions 4.1.136.Final and 4.2.16.Final.

An attacker able to control the filename in a multipart HTTP request can inject arbitrary MIME headers into the multipart body part. This can lead to HTTP header injection attacks, potentially affecting the integrity of HTTP requests processed by vulnerable Netty versions. The CVSS 3.1 score is 6.5 (medium severity), reflecting that the vulnerability requires low privileges and no user interaction but impacts integrity without affecting confidentiality or availability.

Upgrade Netty to version 4.1.136.Final or later, or 4.2.16.Final or later, where this vulnerability is fixed. There are no vendor advisories indicating alternative mitigations or that no action is required. Patch status is confirmed fixed in these versions.