CVE-2026-93566 — Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This byp…
Published: 2026-09-18 · CVSS: 6.5 · CVSS 3.1
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7