Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()
Priority MEDIUM 63CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 25 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial io.netty:netty-codec-http (Maven): 4.1.133.Final, 4.2.13.FinalRed Hat: 4 advisoriesRed Hat: 2 fixed, 25 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | 4.2.0.Alpha1 – 4.2.12.Final; up to 4.1.132.Final | — | No fix listed | CNA |
| — | io.netty:netty-codec-http (Maven) | before 4.1.133.Final | 4.1.133.Final | Patch available | GHSA-v8h7-rr48-vmmv |
| — | io.netty:netty-codec-http (Maven) | 4.2.0.Alpha1 to before 4.2.13.Final | 4.2.13.Final | Patch available | GHSA-v8h7-rr48-vmmv |
- netty Vendornetty Affected 4.2.0.Alpha1 – 4.2.12.Final; up to 4.1.132.Final Fixed in — No fix listed CNA
- io.netty:netty-codec-http (Maven) Vendor— Affected before 4.1.133.Final Fixed in 4.1.133.Final Patch available GHSA-v8h7-rr48-vmmv
- io.netty:netty-codec-http (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.13.Final Fixed in 4.2.13.Final Patch available GHSA-v8h7-rr48-vmmv
Remediation
- Fix · GHSA-v8h7-rr48-vmmv io.netty:netty-codec-http (Maven) Fixed in 4.1.133.Final Advisory →
- Fix · GHSA-v8h7-rr48-vmmv io.netty:netty-codec-http (Maven) Fixed in 4.2.13.Final Advisory →
Red Hat 4 advisories
- RHSA-2026:53806 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 security update
- Red Hat JBoss Enterprise Application Platform 7.4.25
- RHSA-2026:53646 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 Security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
- RHSA-2026:53645 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 Security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
Show 1 more Red Hat advisories
- RHSA-2026:53644 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 security pdate
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server | Fixed | RHSA-2026:53644 |
| Red Hat JBoss Enterprise Application Platform 7.4.25 | Fixed | RHSA-2026:53806 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41417
- 2026-10-03 Alias added: GHSA-v8h7-rr48-vmmv
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-22 Affected versions changed · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
References
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2026-41417 · CVE Program
- CVE-2026-41417 · NVD
- FIRST EPSS
- GHSA-v8h7-rr48-vmmv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41417 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences