CVE-2026-89044
Low
No strong exploitation signal.
CVSS base
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS — probability of exploitation (30 days)
0.2%
15.8th percentile
CISA KEV
Not listed
Weakness / dates
CWE-444
Published 2026-09-10 · modified 2026-09-18
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | L | Low |
| Availability | N | None |
Timeline
- 2026-09-10 — Published (NVD)
- 2026-09-18 — Last modified (NVD)
Description
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.
Affected
References
- https://github.com/netty/netty
- https://github.com/netty/netty/blob/netty-4.1.137.Final/codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java#L866
- https://github.com/netty/netty/commit/640d4d3324f7b811a4903d0730c8ccb35500500c
- https://github.com/netty/netty/commit/ca87393b0e9e13c493d213a268e727a6d44e1585
- https://github.com/netty/netty/releases/tag/netty-4.1.138.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.18.Final
- exploit https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c
- https://www.vulncheck.com/advisories/netty-4.1.133-final-through-4.1.137-final-and-4.2.13-final-through-4.2.17-final-http-request-smuggling-via-transfer-encoding