CVE-2026-89044
Received Received - Intake

HTTP Request Smuggling in Netty

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-89044
EUVD
EUVD-2026-75633

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
netty netty 4.2.18.final
netty netty From 4.1.133_final (inc) to 4.1.137_final (inc)
netty netty From 4.2.13_final (inc) to 4.2.17_final (inc)
netty netty From 4.1.133.Final (inc) to 4.1.137.Final (inc)
netty netty From 4.2.13.Final (inc) to 4.2.17.Final (inc)
netty netty to 4.1.137.Final (inc)
netty netty to 4.2.17.Final (inc)
netty netty 4.1.138.final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89044 is an HTTP request smuggling vulnerability in Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final. It occurs due to improper validation of the final transfer coding in the Transfer-Encoding header. Attackers can craft malformed headers like splitting them across lines or using values such as 'chunked, xchunked' to bypass checks. This tricks the server into treating non-chunked messages as chunked, enabling request smuggling attacks.

Detection Guidance

Detecting this vulnerability requires checking Netty versions and monitoring for malformed Transfer-Encoding headers. Use commands like 'find / -name netty*.jar' to locate Netty installations and verify versions against affected ranges (4.1.133.Final to 4.1.137.Final or 4.2.13.Final to 4.2.17.Final). Inspect HTTP traffic for Transfer-Encoding headers with malformed values like 'chunked, xchunked' or multi-line headers using tools like Wireshark or tcpdump.

Impact Analysis

This vulnerability allows attackers to smuggle malicious HTTP requests past security controls, potentially bypassing authentication, accessing unauthorized data, or performing actions on behalf of other users. It could lead to session hijacking, data theft, or manipulation of application behavior. Systems using vulnerable Netty versions may be exposed to these risks if exposed to untrusted networks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited. Proper patching and security controls are necessary to maintain compliance.

Mitigation Strategies

Immediately upgrade Netty to patched versions (4.1.138.Final or later for 4.1.x, 4.2.18.Final or later for 4.2.x). If upgrading is not possible, implement strict HTTP header validation at the network perimeter or reverse proxy level to reject malformed Transfer-Encoding headers. Monitor for exploitation attempts targeting HTTP request smuggling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart