The Netty framework contains multiple security vulnerabilities. CVE-2026-33870 involves HTTP request smuggling due to improper parsing of HTTP/1.1 chunked transfer encoding extension values, which can allow an attacker to interfere with the processing of HTTP requests. CVE-2026-33871 is a denial of service vulnerability caused by flooding with HTTP/2 CONTINUATION frames, potentially exhausting resources and disrupting service availability. These vulnerabilities impact several products, notably Red Hat builds of Apache Camel and Quarkus, as well as HCL BigFix Remote Control. Red Hat has issued security advisories and updates (e.g., Red Hat Build of Apache Camel 4.14 for Quarkus 3.27.3.GA and Quarkus 3.20.6) that include fixes for these issues. Users should apply these official updates to secure their environments.

The HTTP request smuggling vulnerability (CVE-2026-33870) can allow attackers to manipulate HTTP requests, potentially bypassing security controls or causing unintended request handling. The denial of service vulnerability (CVE-2026-33871) can be exploited to flood the system with HTTP/2 CONTINUATION frames, leading to resource exhaustion and service disruption. These impacts can affect the availability and integrity of affected applications using the vulnerable Netty components.

Red Hat has released official security updates addressing these vulnerabilities in their builds of Apache Camel and Quarkus. Users should apply the relevant updates (e.g., Red Hat Build of Apache Camel 4.14 for Quarkus 3.27.3.GA and Quarkus 3.20.6) as soon as possible. Before applying updates, back up existing installations including applications, configuration files, and databases. Follow Red Hat's official guidance for update procedures. No other specific mitigations are indicated by the vendor advisories.