PT-2026-38374 · Netty+2 · Netty+2

Published

2026-05-07

·

Updated

2026-06-11

·

CVE-2026-42581

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final
Description In the HttpObjectDecoder component, the software fails to strip the Content-Length header when an HTTP/1.0 request contains both Transfer-Encoding: chunked and Content-Length headers. While this conflict is handled for HTTP/1.1 messages, the guard is absent for HTTP/1.0. This allows an attacker to send a request that Netty decodes as chunked while leaving the Content-Length header intact in the forwarded HttpMessage. If a downstream proxy or handler prioritizes Content-Length over Transfer-Encoding, it will disagree on message boundaries, enabling request smuggling. This can lead to cache poisoning, session fixation, unauthorized access to internal endpoints, and the bypassing of authentication layers or Web Application Firewalls (WAF). The issue specifically involves the handleTransferEncodingChunkedWithContentLength() function.
Recommendations Update to version 4.1.133.Final or later. Update to version 4.2.13.Final or later.

Exploit

Fix

HTTP Request/Response Smuggling

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CLEANSTART-2026-CP46043
CLEANSTART-2026-DD05788
CLEANSTART-2026-EG39405
CLEANSTART-2026-GX01236
CLEANSTART-2026-LE11246
CLEANSTART-2026-MX76059
CLEANSTART-2026-PM36304
CLEANSTART-2026-PO27799
CLEANSTART-2026-RN56220
CLEANSTART-2026-RU36468
CLEANSTART-2026-VJ37814
CVE-2026-42581
GHSA-XXQH-MFJM-7MV9
OPENSUSE-SU-2026:10795-1
SUSE-SU-2026:2308-1
USN-8401-1

Affected Products

Linuxmint
Netty
Ubuntu