CVE-2026-89044

Published: Sep 10, 2026Modified: Sep 18, 2026

6.9

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

Affected (2)

Products: Netty: Netty

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Netty Netty	4.1.133 ≤ version < 4.1.138
Netty Netty	4.2.13 ≤ version < 4.2.18

Related CWEs

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (8)

https://github.com/netty/netty

Source: disclosure@vulncheck.com

Product

https://github.com/netty/netty/blob/netty-4.1.137.Final/codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java#L866

Source: disclosure@vulncheck.com

Product

https://github.com/netty/netty/commit/640d4d3324f7b811a4903d0730c8ccb35500500c

Source: disclosure@vulncheck.com

Patch

https://github.com/netty/netty/commit/ca87393b0e9e13c493d213a268e727a6d44e1585

Source: disclosure@vulncheck.com

Patch

https://github.com/netty/netty/releases/tag/netty-4.1.138.Final

Source: disclosure@vulncheck.com

Release Notes

https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

Source: disclosure@vulncheck.com

Release Notes

https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c

Source: disclosure@vulncheck.com

ExploitVendor Advisory

https://www.vulncheck.com/advisories/netty-4.1.133-final-through-4.1.137-final-and-4.2.13-final-through-4.2.17-final-http-request-smuggling-via-transfer-encoding

Source: disclosure@vulncheck.com

PatchThird Party Advisory

Timeline

No history available yet.