HTTP Request Smuggling Flaw in Netty Framework
CVE-2026-33870
What is CVE-2026-33870?
The Netty framework, known for its asynchronous and event-driven network application capabilities, exhibits a vulnerability related to the incorrect parsing of quoted strings in the HTTP/1.1 chunked transfer encoding extension values in its versions prior to 4.1.132.Final and 4.2.10.Final. This flaw potentially exposes applications to request smuggling attacks, which can be exploited to manipulate the behavior of web applications, disrupt traffic flow, or bypass security controls. The identified versions have addressed this vulnerability, highlighting the importance of updating to the latest releases to secure network applications against such threats.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
netty < 4.1.132.Final < 4.1.132.Final
netty >= 4.2.0.Alpha1, < 4.2.10.Final < 4.2.0.Alpha1, 4.2.10.Final