CVE-2025-58056: low-severity vulnerability in netty
Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Netty accepts incorrect line endings in HTTP requests, allowing attackers to trick it into processing requests differently than reverse proxies do. This can be exploited to sneak malicious requests past security checks.
Netty incorrectly parses HTTP/1.1 chunk extensions by accepting standalone LF instead of requiring CRLF terminators. When a reverse proxy interprets the request differently due to LF handling, an attacker can craft a request that appears as one message to the proxy but splits into two at the Netty layer, enabling HTTP request smuggling attacks.
In the same product, most dangerous first.