CVE-2026-33870: Netty HTTP Request Smuggling Vulnerability

CVE-2026-33870 Overview

CVE-2026-33870 is an HTTP Request Smuggling vulnerability affecting Netty, a widely-used asynchronous, event-driven network application framework for Java. The vulnerability stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values. This parsing inconsistency enables attackers to craft malicious HTTP requests that are interpreted differently by front-end and back-end servers, potentially bypassing security controls, poisoning web caches, and hijacking user sessions.

Critical Impact

Network-accessible systems running vulnerable Netty versions can be exploited remotely without authentication to conduct HTTP request smuggling attacks, potentially compromising data integrity and enabling further attacks against backend infrastructure.

Affected Products

• Netty versions prior to 4.1.132.Final
• Netty versions prior to 4.2.10.Final

Discovery Timeline

• 2026-03-27 - CVE-2026-33870 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33870

Vulnerability Analysis

This vulnerability falls under CWE-444 (Inconsistent Interpretation of HTTP Requests), commonly known as HTTP Request Smuggling. The flaw exists in how Netty's HTTP/1.1 codec parses chunked transfer encoding extension values that contain quoted strings.

HTTP/1.1 chunked transfer encoding allows servers to send data in discrete chunks, each preceded by its size. The specification (RFC 9110) permits extension parameters to accompany chunk size declarations. Netty's parser mishandles quoted string values within these extensions, creating a discrepancy between how Netty interprets chunk boundaries versus how other HTTP processors (such as reverse proxies, load balancers, or CDNs) parse the same request.

This parsing discrepancy allows attackers to craft requests where Netty and an upstream proxy disagree on where one request ends and another begins. The result is that portions of one user's request can be prepended to another user's request, enabling various attack scenarios including credential theft, cache poisoning, and security control bypass.

Root Cause

The root cause lies in Netty's non-compliant handling of quoted string parsing within chunked transfer encoding extension values. When encountering extension values with special characters or escape sequences inside quoted strings, Netty's parser incorrectly determines the boundary between the chunk size specification and the chunk data itself.

According to RFC 9110, quoted-string parsing must properly handle escaped characters and maintain consistent interpretation across all HTTP processors in the request path. Netty's deviation from this specification creates the ambiguity that enables request smuggling.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends specially crafted HTTP requests to a system where Netty operates behind a proxy or load balancer. The malformed chunked encoding extensions cause the front-end server and Netty to disagree on message boundaries.

The attacker exploits this by embedding a partial HTTP request within what the front-end considers a single request. When the next legitimate user's request arrives, Netty prepends the attacker's smuggled data to it. This can redirect user requests to attacker-controlled endpoints, inject malicious headers, or bypass authentication mechanisms.

For detailed technical analysis of the chunked encoding parsing issues exploited in this vulnerability, refer to the W4KE Blog Post on Funky Chunks and W4KE Blog Post on Funky Chunks 2 which explore similar HTTP request smuggling techniques.

Detection Methods for CVE-2026-33870

Indicators of Compromise

• Unexpected HTTP responses or response mixing reported by legitimate users
• Web application firewall or proxy logs showing malformed chunked transfer encoding with unusual extension values
• Backend logs indicating requests with unexpected or injected headers not present in frontend logs
• Cache entries containing content from different user sessions or contexts

Detection Strategies

• Monitor HTTP traffic for chunked transfer encoding requests with unusual or excessively long extension values
• Implement deep packet inspection rules to detect quoted string anomalies in chunk-size lines
• Deploy HTTP desync detection tools that compare request interpretation between frontend and backend systems
• Audit application logs for signs of request mixing or unexpected request prefixes

Monitoring Recommendations

• Enable verbose logging on Netty-based applications to capture raw HTTP request details
• Configure alerting for HTTP 400 errors that may indicate parser rejection of smuggled requests
• Monitor for unusual patterns in session behavior or authentication failures that could indicate session hijacking
• Review CDN and reverse proxy logs for discrepancies with backend application logs

How to Mitigate CVE-2026-33870

Immediate Actions Required

• Upgrade Netty to version 4.1.132.Final or 4.2.10.Final immediately
• Audit all applications and dependencies that embed Netty for vulnerable versions
• Review Maven, Gradle, or other dependency management configurations to ensure transitive Netty dependencies are also updated
• Consider temporarily blocking or stripping chunked transfer encoding extensions at the reverse proxy layer if immediate patching is not possible

Patch Information

Netty has released patched versions that correctly implement quoted string parsing in chunked transfer encoding extensions. Version 4.1.132.Final addresses the vulnerability for the 4.1.x branch, while version 4.2.10.Final provides the fix for the 4.2.x branch. For complete details, see the GitHub Security Advisory.

Organizations should prioritize this update for any internet-facing Netty deployments or those processing untrusted HTTP traffic.

Workarounds

• Configure frontend proxies to normalize or reject HTTP requests with chunked encoding extensions before they reach Netty
• Implement strict HTTP parsing at the reverse proxy layer to ensure consistent interpretation
• Use HTTP/2 end-to-end where possible, as this vulnerability specifically affects HTTP/1.1 chunked encoding
• Deploy web application firewalls with HTTP desynchronization detection capabilities

# Maven dependency update example for Netty 4.1.x
# Update pom.xml to specify the patched version:
# <dependency>
#     <groupId>io.netty</groupId>
#     <artifactId>netty-all</artifactId>
#     <version>4.1.132.Final</version>
# </dependency>

# Verify no vulnerable versions remain in dependency tree
mvn dependency:tree | grep netty