Medium · published September 10, 2026
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.
| Product | Versions | Fixed in |
|---|---|---|
| netty/netty | ≥ 4.1.133, < 4.1.138 | 4.1.138 |
| netty/netty | ≥ 4.2.13, < 4.2.18 | 4.2.18 |