A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat AMQ Broker 7 | affected | — |
| Red Hat | Red Hat AMQ Clients | affected | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | affected | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | affected | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | unknown | — |
| Red Hat | Red Hat build of Debezium 3 | affected | — |
| Red Hat | Red Hat Build of Keycloak | unknown | — |
| Red Hat | Red Hat Data Grid 8 | unknown | — |
| Red Hat | Red Hat Fuse 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | affected | — |
| Red Hat | Red Hat Single Sign-On 7 | unknown | — |
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Red Hat
Subscribe
|
Red Hat Amq Broker 7
Subscribe
|
|
Redhat
Subscribe
|
Amq Clients
Subscribe
Build Of Apache Camel For Quarkus
Subscribe
Build Of Apache Camel For Spring Boot
Subscribe
Build Of Apicurio Registry
Subscribe
Build Of Debezium 3
Subscribe
Build Of Keycloak
Subscribe
Build Of Quarkus
Subscribe
Data Grid 8
Subscribe
Jboss Enterprise Application Platform
Subscribe
Quay 3
Subscribe
Single Sign-on
Subscribe
|
Project Subscriptions
| Vendors | Products |
|---|---|
|
Red Hat
Subscribe
|
Red Hat Amq Broker 7
Subscribe
|
|
Redhat
Subscribe
|
Amq Broker
Subscribe
Amq Clients
Subscribe
Apicurio Registry
Subscribe
Build Keycloak
Subscribe
Build Of Apache Camel For Quarkus
Subscribe
Build Of Apache Camel For Spring Boot
Subscribe
Build Of Apicurio Registry
Subscribe
Build Of Debezium 3
Subscribe
Build Of Keycloak
Subscribe
Build Of Quarkus
Subscribe
Camel Quarkus
Subscribe
Camel Spring Boot
Subscribe
Data Grid 8
Subscribe
Debezium
Subscribe
Jboss Data Grid
Subscribe
Jboss Enterprise Application Platform
Subscribe
Jboss Fuse
Subscribe
Quay 3
Subscribe
Red Hat Single Sign On
Subscribe
Single Sign-on
Subscribe
|
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.
References
History
Mon, 21 Sep 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Red Hat
Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on |
|
| Vendors & Products |
Red Hat
Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on |
Mon, 21 Sep 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | ||
| Vendors & Products |
Redhat quarkus
|
|
| References |
|
Sat, 19 Sep 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch | A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions. |
Fri, 18 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch | |
| Title | Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line | |
| First Time appeared |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-1035 | |
| CPEs | cpe:/a:redhat:amq_broker:7 cpe:/a:redhat:amq_clients:2023 cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:debezium:3 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-22T14:28:43.220Z
Reserved: 2026-09-18T10:00:52.431Z
Link: CVE-2026-93566
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-18T15:17:20.290
Modified: 2026-09-21T18:17:16.527
Link: CVE-2026-93566
Redhat
OpenCVE Enrichment
Updated: 2026-09-21T19:25:31Z
Weaknesses