6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42585

CVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42585

CVE-2026-42585:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-http	maven	>= 4.2.0.Alpha1, <= 4.2.12.Final	4.2.13.Final
io.netty:netty-codec-http	maven	<= 4.1.132.Final	4.1.133.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Netty's HttpObjectDecoder class, which is responsible for parsing HTTP requests. The core of the issue is a failure to adhere to RFC 9112 regarding the Transfer-Encoding header. The specification mandates that if chunked transfer coding is used, it must be the final encoding listed in the header. If it is not, the server must reject the request.

Before the patch, Netty's HttpObjectDecoder would incorrectly accept a header such as Transfer-Encoding: chunked, identity. It would treat the request as chunked and ignore the Content-Length header. When Netty is deployed behind a front-end proxy that does not perform the same validation and instead prioritizes the Content-Length header, a desynchronization occurs, leading to an HTTP Request Smuggling vulnerability.

The fix was applied in the readHeaders method, which is a private method called by the public decode method of the HttpObjectDecoder class. The patch adds a check to ensure that if Transfer-Encoding is present and contains chunked, then chunked must be the last value. If this check fails, it throws an IllegalArgumentException, effectively rejecting the malformed request.

Therefore, the function io.netty.handler.codec.http.HttpObjectDecoder.decode is the primary vulnerable function. It is the main entry point for the decoding logic and would be present in any runtime profile or stack trace when a malicious request triggers this vulnerability.

Vulnerable functions

io.netty.handler.codec.http.HttpObjectDecoder.decode

codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java

The `decode` method is the entry point for parsing raw byte data into HTTP objects. It internally calls the `readHeaders` method to process HTTP headers. The vulnerability existed because, prior to the patch, the logic within this execution path did not properly validate the `Transfer-Encoding` header. It would incorrectly process a request with a header like `Transfer-Encoding: chunked, identity` as a chunked request, which violates RFC 9112. This behavior could be exploited for HTTP request smuggling when Netty is behind a proxy that interprets the request differently (e.g., by honoring the `Content-Length` header). The `decode` function is the top-level function in the decoder that would be active during the processing of the malicious request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.