CVE-2026-93566: Netty HTTP Request Smuggling RCE Vulnerability

CVE-2026-93566 Overview

A flaw in the Netty asynchronous event-driven network application framework allows remote attackers to perform HTTP request smuggling. The vulnerability stems from insufficient validation of the chunk-size line in chunked-transfer-encoded HTTP requests. Attackers can embed control characters that bypass Netty's strict parsing checks and inject arbitrary HTTP requests into the stream. Successful exploitation can lead to information disclosure, cache poisoning, or unauthorized actions performed against back-end systems that trust the front-end proxy. The issue is tracked under CWE-1035 and has been addressed in Red Hat advisories.

Critical Impact
Remote unauthenticated attackers can smuggle HTTP requests through Netty-based servers and proxies, leading to information disclosure and unauthorized backend actions.

Affected Products

Netty framework (as shipped in affected Red Hat products)
Red Hat products referenced in advisory RHSA-2026:69440
Red Hat products referenced in advisory RHSA-2026:69470

Discovery Timeline

2026-09-18 - CVE-2026-93566 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93566

Vulnerability Analysis

Netty parses HTTP/1.1 chunked transfer encoding by reading a hexadecimal chunk-size line followed by CRLF, then reading that many bytes of body content. The vulnerability lies in Netty's chunk-size line validator, which fails to reject certain control characters embedded within the size token. When a downstream server and Netty disagree on where a chunk ends, an attacker can craft a request whose body Netty treats as trailing data but the back end interprets as a new, independent HTTP request.

This desynchronization is the basis of HTTP request smuggling. The smuggled request executes with the trust boundary of the proxied connection, potentially bypassing front-end authentication and access controls. Attackers can use this to hijack sessions of subsequent users, poison shared caches, or read sensitive response data intended for other clients.

Root Cause

The root cause is incomplete input validation on the chunk-size line of HTTP chunked-encoded requests. Netty's parser permits control characters that HTTP specifications forbid within the token, allowing the same byte stream to be interpreted differently by Netty and upstream or downstream HTTP components.

Attack Vector

Exploitation requires network access to a service running a vulnerable Netty version, typically fronted by another HTTP intermediary. No authentication or user interaction is required. The attacker sends a single crafted HTTP request containing control characters within the chunk-size line to trigger the parser desynchronization. See the Red Hat CVE record for CVE-2026-93566 for additional technical details.

Detection Methods for CVE-2026-93566

Indicators of Compromise

Inbound HTTP requests containing non-hexadecimal or control characters (0x00-0x1F excluding CRLF) within Transfer-Encoding: chunked chunk-size lines.
Unexpected duplicate Host, Content-Length, or Transfer-Encoding headers appearing in back-end logs but not proxy logs.
Anomalous request pairings where a single client TCP connection yields responses for URLs the client never requested.

Detection Strategies

Enable strict HTTP parser logging on upstream reverse proxies and correlate request counts between the proxy and the Netty-based back end.
Deploy web application firewall rules that reject chunked requests whose chunk-size token contains anything other than [0-9a-fA-F] followed by optional chunk extensions and CRLF.
Alert on HTTP 400 responses spikes from Netty services, which can indicate probing for smuggling primitives.

Monitoring Recommendations

Capture and retain full HTTP request headers and framing metadata in a centralized data lake for retrospective analysis.
Monitor for cache-poisoning symptoms such as user-specific content served to unrelated sessions.
Track outbound traffic from Netty services for unexpected internal endpoint access that could indicate smuggled requests.

How to Mitigate CVE-2026-93566

Immediate Actions Required

Apply vendor updates from Red Hat advisories RHSA-2026:69440 and RHSA-2026:69470 to affected systems.
Inventory all applications and middleware that embed the Netty framework and prioritize public-facing services first.
Enforce strict HTTP parsing on any front-end proxy to reject malformed chunked requests before they reach Netty.

Patch Information

Red Hat has released fixed packages tracked in RHSA-2026:69440 and RHSA-2026:69470. Consult the Red Hat Bug Report #2536954 for component-level fix mapping and upgrade to the patched Netty version referenced by your distribution.

Workarounds

Configure upstream reverse proxies to normalize or reject HTTP requests using Transfer-Encoding: chunked when a Content-Length header is also present.
Terminate HTTP/1.1 at a hardened proxy and forward normalized HTTP/2 requests to Netty back-end services where feasible.
Deploy WAF signatures that block control characters in chunk-size lines until patching is complete.

bash

# Example NGINX hardening to reject ambiguous framing before it reaches Netty
http {
    # Drop requests that present conflicting framing headers
    map $http_transfer_encoding $bad_framing {
        default 0;
        "~*chunked" 1;
    }

    server {
        listen 443 ssl;
        if ($bad_framing = 1) {
            set $flag "${flag}A";
        }
        if ($http_content_length != "") {
            set $flag "${flag}B";
        }
        if ($flag = "AB") { return 400; }

        location / {
            proxy_http_version 1.1;
            proxy_pass http://netty_backend;
        }
    }
}