Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 13 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | 4.1.133.Final to before 4.1.138.Final; 4.2.13.Final to before 4.2.18.Final | 4.1.138.Final, 4.2.18.Final | Patch available | CNA |
- netty Vendornetty Affected 4.1.133.Final to before 4.1.138.Final; 4.2.13.Final to before 4.2.18.Final Fixed in 4.1.138.Final, 4.2.18.Final Patch available CNA
Remediation
- Fix · CNA netty (netty) Fixed in 4.1.138.Final, 4.2.18.Final
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-89044
- 2026-10-03 Alias added: GHSA-77qf-r755-9gcw
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
Patch 2
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2026-89044 · CVE Program
- CVE-2026-89044 · NVD
- FIRST EPSS
- GHSA-77qf-r755-9gcw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-89044 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences