Netty HTTP request smuggling via chunked/Content-Length before 4.2.13.Final
CVE-2026-42581 Published on May 13, 2026

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-42581 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is a HTTP Request Smuggling Vulnerability?

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.

CVE-2026-42581 has been classified to as a HTTP Request Smuggling vulnerability or weakness.

Products Associated with CVE-2026-42581

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-42581 are published in these products:

Netty

Canonical Ubuntu Linux

Red Hat Cryostat

Red Hat Openshift Devspaces

Red Hat Quarkus

Red Hat Amq Streams

Red Hat Serverless

Red Hat Amq Broker

Red Hat Amq Clients

Red Hat Camel Quarkus

Red Hat Camel Spring Boot

Red Hat Service Registry

Red Hat Apicurio Registry

Red Hat Debezium

Red Hat Build Keycloak

Red Hat Optaplanner

Red Hat Jboss Data Grid

Red Hat Enterprise Linux Ai

Red Hat Jboss Fuse

Red Hat Jboss Enterprise Application Platform

Red Hat Jbosseapxp

Red Hat Openshift Ai

Red Hat Jboss Enterprise Bpms Platform

Red Hat Satellite

Red Hat Single Sign On

Red Hat Apache Camel Spring Boot

Oracle

Red Hat Jboss Enterprise Application Platform Els

Red Hat Kafka

Affected Versions

netty:

Version >= 4.2.0.Alpha1, < 4.2.13.Final is affected.
Version < 4.1.133.Final is affected.

Red Hat Cryostat 4 on RHEL 9:

Version 4.2.0-10 and below * is unaffected.

Red Hat Cryostat 4 on RHEL 9:

Version 4.2.0-10 and below * is unaffected.

Red Hat Cryostat 4 on RHEL 9:

Version 4.2.0-10 and below * is unaffected.

Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16:

Version codec-http and below * is unaffected.

Red Hat build of Quarkus 3.27.4:

Version codec-http and below * is unaffected.

Red Hat build of Quarkus 3.33.2: Red Hat JBoss Enterprise Application Platform 7.4.25:

Version codec-http and below * is unaffected.