Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
Historical advisory recorded 6 Nov 2026 12:03:43 UTC. Read the latest advisory.
cve-program · CVE-2026-93566
PublishedA flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-93566
PublishedIo.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
- Source published
- 18 Sep 2026 14:19:29 UTC
- Source modified
- 6 Nov 2026 10:25:58 UTC
- Saved here
- 6 Nov 2026 12:03:43 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N