CVE-2026-33870 Security Details

CVE ID

CVE-2026-33870

CWE

CWE-444

CVE Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Published

Mar 27, 2026

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.028%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

io/netty/handler/codec/http/HttpMessageDecoder.decode(Lio/netty/channel/ChannelHandlerContext;Lio/netty/buffer/ByteBuf;)Ljava/lang/Object;

JVMVulnerable params: 1

io/netty/handler/codec/http/HttpObjectDecoder.decode(Lio/netty/channel/ChannelHandlerContext;Lio/netty/buffer/ByteBuf;Ljava/util/List;)V

JVMVulnerable params: 1

org/jboss/netty/handler/codec/http/HttpMessageDecoder.decode(Lorg/jboss/netty/channel/ChannelHandlerContext;Lorg/jboss/netty/channel/Channel;Lorg/jboss/netty/buffer/ChannelBuffer;Lorg/jboss/netty/handler/codec/http/HttpMessageDecoder$State;)Ljava/lang/Object;

JVMVulnerable params: 2

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-pwqr-wmgm-9rr8THIRD_PARTY