Netty EUVD-2026-83386

Exploitation targets an application using Netty's HTTP/1 decoder to parse inbound requests containing malformed Transfer-Encoding headers. The vector is remote and unauthenticated (PR:N/UI:N) against reachable HTTP endpoints, but practical impact typically requires Netty to be chained with another HTTP intermediary (reverse proxy, load balancer, CDN, or cache) whose Transfer-Encoding interpretation differs from Netty's - the parsing discrepancy is what enables smuggling. Limiting factors: HTTP/1 must be in use (HTTP/2-only paths are not implicated), the endpoint must be network-reachable, and a suitably mismatched upstream/downstream parser must exist for meaningful control bypass; a standalone Netty service with no differing intermediary sees reduced practical impact.

CVSS 3.1 rates this 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N): network-reachable, low-complexity, unauthenticated, no user interaction, with partial confidentiality and integrity impact and no availability impact - a profile consistent with HTTP request smuggling rather than a full-compromise flaw. No EPSS score, no CISA KEV listing, and no public POC were supplied, so this is no public exploit identified at time of analysis; real-world priority is therefore driven by exposure rather than confirmed exploitation. The 'RCE' tag in the input is inconsistent with both the description (HTTP request smuggling / control bypass) and the CVSS impact metrics (C:L/I:L/A:N, no code-execution signal) - treat the RCE label as mislabeled, not as evidence of remote code execution. Request smuggling risk is highly architecture-dependent: it materializes when Netty sits behind or in front of another HTTP intermediary (reverse proxy, load balancer, cache) that parses Transfer-Encoding differently, so the practical severity varies by deployment. Assigned CWE-1035 is a category identifier rather than the specific weakness; the accurate mapping is CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling) - verify with Red Hat.

An unauthenticated remote attacker sends a specially crafted HTTP/1 request with a malformed Transfer-Encoding header to a service built on Netty that sits behind or ahead of another HTTP intermediary. Because Netty's decoder validates the header incompletely, the attacker desynchronizes request boundaries and smuggles a second request, bypassing front-end security controls or reaching unauthorized resources/other users' responses. No public exploit code was provided in the input, and success depends on a parsing discrepancy between Netty and the paired proxy/cache.