Improper Input Validation in Netty HTTP Decoder Affects Multiple Applications

CVE-2026-93566

What is CVE-2026-93566?

A vulnerability exists in the Netty HTTP decoder that allows malformed chunk size lines to bypass strict validation checks. The absence of chunk extensions in the size line means that input, such as a chunk containing an unvalidated CR character, could be accepted. This flaw can facilitate HTTP request smuggling, potentially enabling attackers to craft malicious requests that exploit the way web servers or proxies process incoming HTTP traffic. Proper adherence to RFC 9112 is crucial to ensure secure handling of chunked transfer encodings.

References