Netty CVE-2026-93574

Exploitation requires the Netty-based service to process HTTP/1.1 chunked transfer-encoding and, for meaningful smuggling impact, to sit behind or in front of another HTTP intermediary (proxy/load balancer/backend) that parses the chunk-size token differently. The trigger is a crafted chunk-size token containing whitespace after the hex digits. No authentication or user interaction is needed (PR:N/UI:N), and default configurations of affected products are reachable. What limits real impact: the flaw is only exploitable to a useful degree in multi-tier proxy/backend topologies where a parsing discrepancy exists; a standalone Netty endpoint with no differing upstream/downstream parser yields little smuggling advantage.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5) correctly reflects HTTP request smuggling: remotely and unauthenticated exploitable with low complexity, but with limited confidentiality/integrity/availability impact rather than direct code execution. The signals are internally consistent - network vector matches the 'remote attacker sending a crafted HTTP/1.1 chunk-size token' description, and PR:N matches an unauthenticated proxy/backend attack. No EPSS score, CISA KEV listing, or public POC was provided in the input, so per the precision rules this is 'no public exploit identified at time of analysis.' Real-world risk is elevated by the affected component: Netty's netty-codec-http is embedded in a very large number of Java services (the Red Hat CPE list alone spans Keycloak, Quarkus, Data Grid, AMQ, Camel, Debezium, Fuse, Apicurio, JBoss EAP). However, smuggling only becomes impactful in specific proxy/backend chain topologies, so this is a real-but-conditional issue rather than a critical drop-everything flaw. Note: the input 'Authentication Bypass' tag overstates the flaw - the CWE-444 request smuggling can facilitate control bypass but is not itself an authentication bypass.

An attacker sends an HTTP/1.1 request with a chunk-size token containing trailing (post-digit) whitespace to a front-end proxy that forwards to a Netty-based backend. The proxy and Netty disagree on where the chunk (and thus the request boundary) ends, letting the attacker smuggle a second request to bypass front-end security controls or reach unauthorized resources. No public exploit code was identified in the provided data.