Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. (CVE-2026-42585)

Netty, an asynchronous event-driven network application framework, incorrectly parses malformed Transfer-Encoding headers in versions prior to 4.2.13.Final and 4.1.133.Final. This parsing flaw enables HTTP request smuggling attacks, which can allow attackers to interfere with the processing of HTTP requests by the server. The vulnerability is addressed in Netty versions 4.2.13.Final and 4.1.133.Final. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has released patches to remediate this issue.

The vulnerability allows an attacker to perform HTTP request smuggling by exploiting incorrect parsing of malformed Transfer-Encoding headers. This can lead to integrity issues in HTTP request processing, potentially allowing attackers to manipulate or bypass security controls. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.

A vendor patch is available and should be applied to upgrade Netty to version 4.2.13.Final or 4.1.133.Final or later. The vendor advisory (https://ubuntu.com/security/notices/USN-8401-1) provides official fixes. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor.