Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads

Summary

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Timeline

1. Sep 26, 2019, 3:28 PM UTCCVE published
2. Oct 8, 2026, 9:12 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 9:14 PM UTCRecord last updated

Affected versions

• io.netty:netty-allMaven

  From 4.0.0.Beta1 · fixed in 4.1.42.Final

• org.jboss.netty:nettyMaven

  through 3.2.9.Final

• io.netty:nettyMaven

  From 3.3.0.Final · through 4.0.0.Alpha8

References 25