CVE-2026-93562 — Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending s…
Published: 2026-09-18 · CVSS: 6.5 · CVSS 3.1
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7