CRLF Injection Vulnerability in Netty Network Application Framework
CVE-2025-67735
6.5MEDIUM
What is CVE-2025-67735?
The Netty Network Application Framework is vulnerable to a CRLF injection caused by improper handling of request URIs in the HttpRequestEncoder component. This vulnerability, present in versions prior to 4.1.129.Final and 4.2.8.Final, allows attackers to exploit request smuggling techniques if the URI is not properly sanitized. Applications utilizing this framework may inadvertently become targets, thus necessitating an upgrade to the fixed versions to mitigate potential risks.
Affected Version(s)
netty >= 4.2.0.Alpha1, < 4.2.8.Final < 4.2.0.Alpha1, 4.2.8.Final
netty < 4.1.129.Final < 4.1.129.Final