PT-2026-37246 · Netty · Netty

Aest3Ra

+2

·

Published

2026-05-05

·

Updated

2026-05-18

·

CVE-2026-41417

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final
Description Request-line validation can be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created and its URI is subsequently modified using the setUri() function. While constructors reject CRLF (Carriage Return Line Feed) and whitespace characters to prevent start-line corruption, setUri() does not perform this validation. Consequently, HttpRequestEncoder and RtspEncoder write the URI into the request line verbatim. If attacker-controlled input is passed to setUri(), it enables CRLF injection and the insertion of additional HTTP or RTSP requests. This can lead to HTTP request smuggling, desynchronization on the HTTP side, and request injection on the RTSP side.
Recommendations Update to version 4.1.133.Final or later. Update to version 4.2.13.Final or later. As a temporary workaround, avoid using the setUri() function with attacker-controlled input.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

Related Identifiers

CLEANSTART-2026-DD05788
CLEANSTART-2026-GX01236
CLEANSTART-2026-JU62349
CLEANSTART-2026-JW30455
CLEANSTART-2026-LE11246
CLEANSTART-2026-MM00120
CLEANSTART-2026-PM36304
CLEANSTART-2026-PO27799
CLEANSTART-2026-RN56220
CLEANSTART-2026-VJ37814
CLEANSTART-2026-WG59699
CLEANSTART-2026-WK99982
CVE-2026-41417
GHSA-V8H7-RR48-VMMV
OPENSUSE-SU-2026:10795-1

Affected Products

Netty