CVE-2026-89044

Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

MEDIUM

6.5

CVSS Score

Published: September 10, 2026 at 05:39 PM UTC

Updated: September 18, 2026 at 06:17 PM UTC

1 product affected across 1 vendorNetty

Using netty by netty?

Get instant alerts when new vulnerabilities affect netty - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Netty · Nettymaven

95%

4.1.133 ≤ v < 4.1.1384.1.133.Final ≤ v < 4.1.138.Final4.1.133.final ≤ v < 4.1.138.final4.2.13 ≤ v < 4.2.184.2.13.Final ≤ v < 4.2.18.Final4.2.13.final ≤ v < 4.2.18.final4.1.133.Final 4.2.13.Final

Affected range stops below 4.1.138, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.1.138.final, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.2.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.2.18.final, so it looks safe — our inference, not a vendor statement