Loading vulnerability…
HTTP Request Smuggling in Netty Chunk Extension Parsing
CVE-2026-33870 is an HTTP request smuggling vulnerability in Netty's netty-codec-http component. Affected versions incorrectly parse quoted strings in HTTP/1.1 chunked transfer encoding extension values. Specially crafted requests can exploit inconsistent interpretation of request boundaries between HTTP-processing components, allowing attacker-controlled requests to be smuggled through the request chain. The vulnerability affects Netty 4.1.x versions before 4.1.132.Final and 4.2.x versions before 4.2.10.Final.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can permit arbitrary HTTP request injection and bypass of security or access controls. Depending on the deployment, consequences can include cache poisoning, unauthorized information access, and possible session hijacking. Red Hat assigns a CVSS v3.1 score of 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, emphasizing high integrity impact without directly scored confidentiality or availability impact.
If you can’t patch tonight, do this now.
Until patched, configure upstream proxies or gateways to reject malformed chunked requests, specifically those containing CR or LF bytes within chunk extension values before the terminating CRLF. Use RFC-compliant frontends that return HTTP 400 for these malformed requests, and verify that the filtering applies to every route reaching the vulnerable parser. Red Hat states that no mitigation is available or meets its product security criteria; upstream filtering should therefore not be treated as a vendor-approved substitute for patching.
Patch, then assume compromise.
Upgrade io.netty:netty-codec-http to 4.1.132.Final or later in the 4.1.x branch, or 4.2.10.Final or later in the 4.2.x branch. For applications bundling Netty, install the applicable vendor-supported fixed release rather than replacing bundled dependencies outside supported procedures. Identified fixed releases include Red Hat AMQ Broker 7.12.7, 7.13.5, and 7.14.0; JBoss EAP 8.1.6; and Java Buildpack 4.95.0.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.