Netty's DefaultHttpRequest and DefaultFullHttpRequest classes allow bypassing URI validation when the URI is changed via the setUri() method after object creation. This leads to CRLF injection enabling HTTP request smuggling and RTSP request injection. The issue arises because constructors validate the URI to prevent injection, but setUri() does not. Consequently, malicious input passed to setUri() is encoded verbatim by HttpRequestEncoder or RtspEncoder, allowing injection of additional requests. Proof-of-concept code demonstrates how multiple HTTP or RTSP requests can be injected and parsed from a single request line.