Request-Line Validation Bypass in Netty Framework

CVE-2026-41417

What is CVE-2026-41417?

A vulnerability in the Netty framework allows an attacker to bypass request-line validation when creating a DefaultHttpRequest or DefaultFullHttpRequest. The integrity check on the URI, which is performed during construction, is ignored when the URI is later modified using setUri(). This omission permits the injection of CRLF characters and whitespace into the request line, potentially leading to malicious HTTP request smuggling and RTSP request injection attacks. This vulnerability poses significant risks if attacker-controlled input successfully alters the request, facilitating desynchronization or unexpected behaviors in client-server interactions. The issue has been addressed in versions 4.2.13.Final and 4.1.133.Final of the Netty framework.

References