6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67735

CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the URI. Any application / framework using HttpRequestEncoder can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67735

CVE-2025-67735:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-http	maven	>= 4.2.0.Alpha1, < 4.2.8.Final	4.2.8.Final
io.netty:netty-codec-http	maven	< 4.1.129.Final	4.1.129.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CRLF injection (CWE-93) in Netty's HTTP codec, which can lead to HTTP request smuggling. The root cause is the lack of input validation on the request URI when creating HttpRequest objects. Specifically, the constructors for DefaultHttpRequest and DefaultFullHttpRequest accepted a URI containing CRLF sequences without sanitization.

The provided patch addresses this by introducing validation logic within the constructors. A new private method, HttpUtil.validateRequestLineTokens, is added to check for illegal characters (including carriage returns and line feeds) in the URI. The constructors for DefaultHttpRequest and DefaultFullHttpRequest are updated to call this validation method.

When an application using a vulnerable Netty version constructs an HTTP request with user-supplied data in the URI, an attacker can inject CRLF sequences. When this malformed request object is passed to io.netty.handler.codec.http.HttpRequestEncoder, the encoder writes the URI, including the injected CRLF sequences, directly to the output buffer. This allows an attacker to craft a single message that is interpreted by a downstream server as two separate HTTP requests, leading to request smuggling.

The identified vulnerable functions are the constructors that were modified by the patch to include the missing validation. These constructors were the entry point for the malicious data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.