CVE-2026-50020: Netty HttpObjectDecoder RCE Vulnerability

CVE-2026-50020 Overview

CVE-2026-50020 affects Netty, a widely deployed asynchronous network application framework used for building protocol servers and clients in Java. The vulnerability resides in HttpObjectDecoder, which silently skips every byte for which Character.isISOControl(b) returns true (0x00–0x1F and 0x7F) along with whitespace before reading the first request-line. This permissive parsing exceeds the RFC 9112 §2.2 allowance for empty CRLF lines and creates an HTTP request smuggling primitive [CWE-444]. The flaw impacts Netty versions prior to 4.1.135.Final and 4.2.15.Final.

Critical Impact
Attackers can leverage absorbed NUL, SOH, STX, and other control characters to desynchronize front-end and back-end HTTP parsers, enabling request-boundary confusion in pipelined or multiplexed transports.

Affected Products

Netty versions prior to 4.1.135.Final
Netty versions prior to 4.2.15.Final
Applications and frameworks embedding the affected netty-codec-http module

Discovery Timeline

2026-06-12 - CVE-2026-50020 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50020

Vulnerability Analysis

The vulnerability stems from overly permissive preprocessing inside Netty's HttpObjectDecoder. Before parsing the request-line, the decoder discards any byte classified as an ISO control character by Character.isISOControl(b), covering the ranges 0x00–0x1F and 0x7F, as well as whitespace.

RFC 9112 §2.2 only permits servers to ignore empty CRLF sequences that precede the request-line. This narrow allowance exists to tolerate legacy HTTP/1.0 POST client behaviors. Netty's behavior extends far beyond that scope by absorbing NUL (0x00), SOH (0x01), STX (0x02), and other non-CRLF control bytes.

When Netty is deployed behind a reverse proxy, load balancer, or CDN that parses HTTP framing differently, the parser disagreement creates an HTTP request smuggling condition. An attacker can craft a payload where the front-end treats embedded control bytes as part of one request while Netty treats them as ignorable padding, splitting the stream into a different sequence of requests than the front-end intended.

Root Cause

The root cause is the use of Character.isISOControl(b) as a skip predicate in the pre-request-line parsing loop of HttpObjectDecoder. The check accepts a broad class of bytes that RFC 9112 does not authorize servers to ignore, violating the principle of strict parsing on input boundaries.

Attack Vector

Exploitation requires network access to a system running an affected Netty version behind a front-end component that performs its own HTTP parsing. The attacker submits a crafted HTTP request containing control bytes positioned to be absorbed by Netty but interpreted as message data or framing by the upstream proxy. This produces conflicting request boundaries between the two parsers, enabling smuggled requests that may bypass authentication, poison caches, or hijack subsequent client sessions on pooled connections.

No proof-of-concept exploit code has been published. The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-hvcg-qmg6-jm4c.

Detection Methods for CVE-2026-50020

Indicators of Compromise

HTTP requests containing NUL (0x00), SOH (0x01), STX (0x02), or other non-printable control bytes positioned before the request-line
Discrepancies between front-end proxy access logs and Netty application logs for request counts, methods, or paths on the same TCP connection
Unexpected response interleaving or session crossover reported by users on pooled or keep-alive connections

Detection Strategies

Inspect HTTP request streams at the proxy layer for control characters in the 0x00–0x1F range outside of CRLF positions and flag or drop them
Compare request counts and request-line content between upstream proxies and Netty back-ends to surface parser desynchronization
Audit dependency manifests (pom.xml, build.gradle) for netty-codec-http versions below 4.1.135.Final or 4.2.15.Final

Monitoring Recommendations

Enable verbose HTTP framing logs on front-end proxies to capture raw byte sequences preceding the request-line
Monitor for sudden increases in 400 Bad Request responses or connection resets that may indicate smuggling probes
Alert on unusual sequences of requests from a single client where authentication context shifts unexpectedly

How to Mitigate CVE-2026-50020

Immediate Actions Required

Upgrade Netty to version 4.1.135.Final or 4.2.15.Final or later across all services using netty-codec-http
Identify transitive dependencies that pull in vulnerable Netty versions through frameworks such as Vert.x, Reactor Netty, Armeria, gRPC-Java, or Spring WebFlux
Audit reverse proxy and CDN configurations for strict HTTP parsing modes that reject control characters in request streams

Patch Information

Netty addressed the vulnerability in Netty 4.1.135.Final and Netty 4.2.15.Final. The patched versions narrow the pre-request-line skip logic to align with RFC 9112 §2.2, no longer absorbing arbitrary ISO control characters. Full details are documented in GitHub Security Advisory GHSA-hvcg-qmg6-jm4c.

Workarounds

Deploy a front-end proxy configured to reject HTTP requests containing control bytes outside of permitted positions until upgrade is possible
Disable HTTP keep-alive and pipelining on affected endpoints to reduce the impact of request-boundary confusion
Apply Web Application Firewall (WAF) rules that strip or block requests containing NUL, SOH, STX, and similar control bytes in HTTP headers

bash

# Example Maven dependency update for the patched Netty version
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.135.Final
mvn dependency:tree | grep netty