CVE-2026-33870: high-severity vulnerability in netty
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Netty has a flaw in how it reads certain HTTP request formatting rules, allowing attackers to send specially crafted requests that can bypass security checks or trick the server into processing malicious commands.
Netty versions prior to 4.1.132.Final and 4.2.10.Final contain an HTTP request smuggling vulnerability (CWE-444) in chunked transfer encoding extension parsing. The framework incorrectly interprets quoted strings in chunk extension values, permitting an attacker to inject ambiguous requests that are processed differently by intermediary proxies and backend servers, potentially leading to request filtering bypass or cache poisoning.
In the same product, most dangerous first.