HTTP Request Smuggling Flaws Expose Netty, aiohttp, and Undici to Desync Attacks

New research and vendor advisories have highlighted a broader class of HTTP desynchronization and request smuggling risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on CRLF-powered desync attacks warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions.

Red Hat documented multiple affected implementations under CWE-444. CVE-2026-33870 in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. CVE-2024-52304 in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. CVE-2026-1525 in Undici allows duplicate Content-Length headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as smugchunks has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.