A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat AMQ Broker 7 | affected | — |
| Red Hat | Red Hat AMQ Clients | affected | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | affected | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | affected | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | unknown | — |
| Red Hat | Red Hat build of Debezium 3 | affected | — |
| Red Hat | Red Hat Build of Keycloak | unknown | — |
| Red Hat | Red Hat build of Quarkus | unknown | — |
| Red Hat | Red Hat Data Grid 8 | unknown | — |
| Red Hat | Red Hat Fuse 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | affected | — |
| Red Hat | Red Hat Single Sign-On 7 | unknown | — |
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
| Vendors | Products |
|---|---|
|
Redhat
Subscribe
|
Amq Broker
Subscribe
Amq Clients
Subscribe
Apicurio Registry
Subscribe
Build Keycloak
Subscribe
Camel Quarkus
Subscribe
Camel Spring Boot
Subscribe
Debezium
Subscribe
Jboss Data Grid
Subscribe
Jboss Enterprise Application Platform
Subscribe
Jboss Fuse
Subscribe
Quarkus
Subscribe
Red Hat Single Sign On
Subscribe
|
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.
References
History
Sat, 19 Sep 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch | A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions. |
Fri, 18 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch | |
| Title | Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line | |
| First Time appeared |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-1035 | |
| CPEs | cpe:/a:redhat:amq_broker:7 cpe:/a:redhat:amq_clients:2023 cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:debezium:3 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-18T20:12:32.112Z
Reserved: 2026-09-18T10:00:52.431Z
Link: CVE-2026-93566
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-18T15:17:20.290
Modified: 2026-09-18T21:18:47.507
Link: CVE-2026-93566
Redhat
OpenCVE Enrichment
Updated: 2026-09-18T23:45:15Z
Weaknesses