Netty CVE-2025-67735

Requires an application that uses Netty's HttpRequestEncoder (typically via HttpClientCodec) to construct outbound HTTP requests AND passes an attacker-influenced or otherwise unsanitized value into the request URI; Netty's default HTTP header validator blocks CRLF in headers but does NOT sanitize the URI, which the encoder writes verbatim. Limiting factors: this is a client-side request encoder, so smuggling targets the upstream/back-end server the Netty client connects to, not the Netty process itself; exploitation is not possible if the application sanitizes/validates URIs or does not route untrusted input into the URI. Affected: netty-codec-http >= 4.2.0.Alpha1 to < 4.2.8.Final and all versions < 4.1.129.Final.

This is a genuine but conditional, medium-severity issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) signals a network-reachable, low-complexity flaw needing no privileges or user interaction, with low confidentiality and integrity impact and no availability impact - consistent with request smuggling (CWE-93) rather than code execution. A working PoC exists in the GHSA advisory, so publicly available exploit code exists; however, this is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation. The most important nuance the raw CVSS hides: this is a library-level defect in the client-side HttpRequestEncoder, so real-world exploitability depends on whether the embedding application actually routes attacker-controlled data into the request URI without sanitization - the PR:N/AC:L rating assumes that untrusted input reaches the URI, which is an application-specific precondition not captured by the vector. Treat as a prioritized patch-soon item (broadly deployed library, public PoC) but not a drop-everything incident, absent evidence the specific application exposes an unsanitized URI path.

An application built on Netty uses HttpClientCodec/HttpRequestEncoder and forwards user-supplied input into the outbound HTTP request URI. An attacker embeds CRLF sequences in that input, causing the encoder to emit a smuggled second request to the upstream/back-end server, enabling HTTP request smuggling such as cache poisoning or access-control bypass. A functional proof-of-concept reproducer is published in the GHSA advisory (AV:N/AC:L), lowering the bar for exploitation.