CVE-2026-93562: Netty HTTP/1 Decoder RCE Vulnerability

CVE-2026-93562 Overview

CVE-2026-93562 is an HTTP request smuggling vulnerability in Netty's HTTP/1 decoder. The flaw stems from incomplete validation of malformed Transfer-Encoding headers. Remote attackers can send specially crafted HTTP requests to inject arbitrary requests downstream. Successful exploitation allows attackers to bypass security controls or access unauthorized resources fronted by Netty-based servers and proxies.

The vulnerability is classified under CWE-1035 and is network-exploitable without authentication or user interaction. Red Hat has published advisories RHSA-2026:69440 and RHSA-2026:69470 addressing affected components in their product portfolio.

Critical Impact

Attackers can smuggle HTTP requests through Netty-fronted infrastructure, bypassing authentication proxies, web application firewalls, and access control layers.

Affected Products

• Netty framework HTTP/1 decoder component
• Red Hat products bundling vulnerable Netty versions (see RHSA-2026:69440)
• Red Hat products referenced in RHSA-2026:69470

Discovery Timeline

• 2026-09-18 - CVE-2026-93562 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93562

Vulnerability Analysis

The vulnerability resides in how Netty's HTTP/1 decoder parses and validates the Transfer-Encoding request header. HTTP request smuggling occurs when a front-end server and back-end server disagree on where one HTTP request ends and the next begins. Netty's incomplete validation of malformed Transfer-Encoding values creates that disagreement.

An attacker sending a crafted request can cause the front-end proxy to interpret request boundaries differently than the Netty back-end. Bytes intended as part of one request become the start of a new, smuggled request. This smuggled request inherits trust from the connection and is processed as if it originated from an authenticated or trusted source.

Consequences include bypassing web application firewall rules, session hijacking through cache poisoning, credential capture from other users on the same connection pool, and access to internal endpoints that are otherwise restricted at the proxy layer.

Root Cause

The root cause is insufficient validation of Transfer-Encoding header values during HTTP/1 message decoding. When the header contains malformed or ambiguous encodings, Netty accepts the request rather than rejecting it or normalizing behavior. This permits desynchronization between Netty and any intermediary HTTP parser.

Attack Vector

Exploitation requires network access to a listener backed by Netty's vulnerable HTTP/1 decoder. No authentication or user interaction is required. The attacker crafts an HTTP request with a manipulated Transfer-Encoding header, then appends smuggled request content in the body. Refer to the Red Hat CVE analysis for protocol-level details.

Detection Methods for CVE-2026-93562

Indicators of Compromise

• HTTP requests containing multiple Transfer-Encoding headers or values with unusual whitespace, casing, or chunked-encoding variants
• Requests where both Content-Length and Transfer-Encoding headers are present
• Unexpected request bodies appearing in log entries as apparent request lines (for example, GET /admin HTTP/1.1 inside a POST body)
• Backend access logs showing requests that were not proxied by the front-end

Detection Strategies

• Deploy web application firewall rules that reject requests with ambiguous or duplicate Transfer-Encoding headers
• Enable strict HTTP parsing at reverse proxies and compare request counts between edge and origin tiers
• Correlate proxy access logs with application logs to identify request-count mismatches per TCP connection
• Alert on HTTP 400 spikes from upstream proxies that indicate desynchronization attempts

Monitoring Recommendations

• Continuously monitor Netty-based services for anomalous request framing and connection reuse patterns
• Track dependency inventories to flag applications running vulnerable Netty versions
• Instrument application logs to record raw header values for Transfer-Encoding and Content-Length during triage windows

How to Mitigate CVE-2026-93562

Immediate Actions Required

• Inventory all applications using Netty as an HTTP/1 server or proxy component
• Apply vendor patches from Red Hat advisories RHSA-2026:69440 and RHSA-2026:69470
• Upgrade transitive Netty dependencies in Java applications to the fixed release identified by the upstream project
• Restart affected services after patching to ensure the vulnerable decoder is unloaded

Patch Information

Red Hat has issued security advisories RHSA-2026:69440 and RHSA-2026:69470 with fixed packages. Consult the Red Hat CVE page and Bugzilla #2536951 for the complete list of affected components and fixed versions. Non-Red Hat consumers of Netty should upgrade to the patched upstream release.

Workarounds

• Place a strict HTTP/1 parser in front of Netty that rejects requests containing both Transfer-Encoding and Content-Length headers
• Disable HTTP keep-alive on affected listeners to eliminate connection reuse abuse, accepting the performance trade-off
• Enforce HTTP/2 end-to-end where supported, since the vulnerability is specific to HTTP/1 decoding
• Configure upstream proxies to normalize or strip malformed Transfer-Encoding header values before forwarding

# Example NGINX front-end hardening to reject ambiguous framing
http {
    # Drop requests presenting both framing headers
    map $http_transfer_encoding $bad_framing {
        default 0;
        "~*chunked" 1;
    }

    server {
        listen 443 ssl;
        if ($bad_framing = 1) {
            if ($http_content_length) { return 400; }
        }
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}