Request Smuggling Vulnerability in Netty Framework by Ethernet

CVE-2026-42581

What is CVE-2026-42581?

The Netty framework is susceptible to a request smuggling vulnerability affecting its HTTP message handling. This arises when an HTTP/1.0 request is sent with both 'Content-Length' and 'Transfer-Encoding: chunked' headers. In such cases, the Netty framework processes the body as chunked despite retaining the 'Content-Length' header, which can mislead downstream proxies or handlers that prioritize 'Content-Length' over 'Transfer-Encoding'. This discrepancy can result in message boundary issues, making it possible for attackers to exploit the vulnerability for malicious purposes. Users are advised to upgrade to Netty versions 4.2.13.Final or 4.1.133.Final to mitigate this issue. For further details, visit the official advisory.

References