The Netty framework contains multiple security vulnerabilities. CVE-2026-33870 is a request smuggling vulnerability arising from improper parsing of HTTP/1.1 chunked transfer encoding extension values in the netty-codec-http component. CVE-2026-33871 is a denial of service vulnerability caused by flooding with HTTP/2 CONTINUATION frames in the netty-codec-http2 component. These vulnerabilities affect several products including HCL BigFix Remote Control and Red Hat builds of Apache Camel and Quarkus. Red Hat has issued security advisories (RHSA-2026:8159 and RHSA-2026:7109) with updates that fix these issues. The advisories recommend applying the updates after backing up existing installations.

The vulnerabilities allow an attacker to perform HTTP request smuggling (CVE-2026-33870) which can lead to bypassing security controls or manipulating HTTP requests, and denial of service (CVE-2026-33871) through flooding with HTTP/2 CONTINUATION frames, potentially disrupting service availability. These impacts affect applications and services using the vulnerable Netty components. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released official security updates that address these vulnerabilities. Users of affected products such as Red Hat Build of Apache Camel and Quarkus should apply the updates RHSA-2026:8159 and RHSA-2026:7109 respectively. Before applying updates, back up all relevant data and configurations. Follow vendor instructions for update procedures. Patch status is confirmed as fixed by the vendor advisories. No additional mitigation steps are indicated beyond applying these official fixes.