Netty's HttpServerCodec in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final has a vulnerability where HTTP response parsing can become desynchronized. This occurs when a client sends a pipelined HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request. The 100 Continue response incorrectly consumes the queued GET method, causing the GET response body to be dropped and the HEAD response body to be misinterpreted as the GET body. This leads to response splitting and unsafe connection reuse. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final contain a vulnerability in the validation of the final transfer coding in the Transfer-Encoding header. This flaw allows attackers to craft malformed encoding declarations to bypass validation and perform HTTP request smuggling attacks by manipulating Transfer-Encoding headers. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch or remediation information is provided in the available data.
Netty's CorsHandler component overwrites existing Vary headers with a fixed value, causing cache poisoning and potential information disclosure. This affects Netty-based web applications that rely on Vary headers like Authorization or Cookie to control caching behavior behind proxies or CDNs. Attackers may retrieve cached sensitive data belonging to other users. The vulnerability is fixed in versions 4.2.17.Final and 4.1.137.Final.
CVE-2026-59921 is a CRLF injection vulnerability in Netty's HttpPostRequestEncoder affecting versions prior to 4.2.16.Final and 4.1.136.Final. The vulnerability arises because user-controlled filenames are directly embedded into multipart Content-Disposition headers without sanitization of CRLF characters. This allows attackers to inject arbitrary MIME headers, potentially leading to MIME header injection, content-type spoofing, and cross-site scripting (XSS) attacks. The flaw requires low privileges but no user interaction and has a high impact on confidentiality and integrity.
A vulnerability in Netty's HttpContentEncoder allows unbounded growth of a per-connection queue due to HTTP/1.1 pipelining. This can lead to resource exhaustion and denial of service when an attacker floods a connection with requests faster than responses are produced. The flaw affects specific versions prior to 4.2.16.Final and 4.1.136.Final.
CVE-2026-59898 is a vulnerability in io.netty:netty-codec-http affecting WebSocket V07/V08 handshakers. The flaw allows an attacker to bypass the required 'Connection: Upgrade' and 'Upgrade: websocket' headers by sending 'Sec-WebSocket-Version: 7', causing the server to complete a WebSocket protocol switch that proxies may not recognize. This can enable HTTP request smuggling and protocol confusion attacks. The issue affects versions >=4.2.0.Final <4.2.16.Final and <4.1.136.Final. Fixed versions are 4.2.16.Final and 4.1.136.Final. The CVSS 4.0 score is 6.3 (medium severity). No known exploits are reported in the wild.
Netty's CorsHandler has a vulnerability in its short-circuit logic that allows bypassing cross-origin request restrictions when the Origin header is set to null. This flaw causes unauthorized requests to reach backend applications despite intended access controls. The issue is due to a logical error in handling null origins, leading to the short-circuit mechanism being bypassed.
CVE-2026-56745 is a high-severity vulnerability in Netty's SPDY-to-HTTP codec (SpdyHttpDecoder) where a pooled ByteBuf is leaked when processing RST_STREAM frames or when content length limits are exceeded. This leak leads to native memory exhaustion. The issue affects versions 4.2.0.Final up to but not including 4.2.16.Final and 4.1.0.Final up to but not including 4.1.136.Final. Fixed versions are 4.2.16.Final and 4.1.136.Final.
A vulnerability in Netty's SPDY header decoding allows a remote unauthenticated attacker to send a compressed SPDY HEADERS block that inflates beyond the configured maxHeaderSize limit, causing excessive CPU and memory usage. This leads to a denial of service (DoS) condition. The issue affects specific versions of io.netty:netty-codec-http prior to fixed releases 4.2.16.Final and 4.1.136.Final.
Netty's SPDY SETTINGS decoder in versions before 4.2.16.Final and 4.1.136.Final accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit without limiting the number of unique setting IDs. This allows a remote unauthenticated SPDY/3.1 peer to send a single large SETTINGS frame that creates over 262,000 map entries, causing significant heap memory growth and CPU usage. This results in a resource exhaustion denial of service condition.
Netty's DefaultHttpRequest and DefaultFullHttpRequest classes allow bypassing URI validation when the URI is changed via the setUri() method after object creation. This leads to CRLF injection enabling HTTP request smuggling and RTSP request injection. The issue arises because constructors validate the URI to prevent injection, but setUri() does not. Consequently, malicious input passed to setUri() is encoded verbatim by HttpRequestEncoder or RtspEncoder, allowing injection of additional requests. Proof-of-concept code demonstrates how multiple HTTP or RTSP requests can be injected and parsed from a single request line.