{"id":"CVE-2026-33870","title":"Netty is an asynchronous, event-driven network application framework","summary":"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request s…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-444"],"vendor":"netty","product":"netty","affected":["netty < 4.1.132","netty >= 4.2.0, < 4.2.10"],"patched":["netty 4.2.10"],"published":"2026-03-27","updated":"2026-09-14","sourceUpdated":"2026-09-14T13:18:17.593","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","label":"security-advisories@github.com"},{"url":"https://w4ke.info/2025/06/18/funky-chunks.html","label":"security-advisories@github.com"},{"url":"https://w4ke.info/2025/10/29/funky-chunks-2.html","label":"security-advisories@github.com"},{"url":"https://www.rfc-editor.org/rfc/rfc9110","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13571","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17668","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17789","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22619","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7109","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7380","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:8159","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33870","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452453","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33870"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870"},{"url":"https://access.redhat.com/errata/RHSA-2026:69459"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-31T13:55:28.970197Z"},"epss":0.0064,"epssPercentile":0.48947,"ingestedAt":"2026-07-03T14:03:36.911Z","slug":"CVE-2026-33870","body":"## Overview\n\nNetty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.\n\n## Affected\n\n- `netty < 4.1.132`\n- `netty >= 4.2.0, < 4.2.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `netty 4.2.10`\n\n## Vendor advisories\n\n- **RHSA-2026:18054** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18054)\n- **RHSA-2026:17789** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:17789)\n- **RHSA-2026:18055** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18055)\n- **RHSA-2026:14276** · Red Hat · fixed in: Red Hat AMQ Broker 7.12.7 · released 2026-05-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:14276)\n- **RHSA-2026:14272** · Red Hat · fixed in: Red Hat AMQ Broker 7.13.5 · released 2026-05-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:14272)\n- **RHSA-2026:8509** · Red Hat · fixed in: Red Hat AMQ Broker 7.14.0 · released 2026-04-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:8509)\n- **RHSA-2026:8159** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · released 2026-04-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:8159)\n- **RHSA-2026:22619** · Red Hat · fixed in: Red Hat Data Grid 8.6.1 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22619)\n- **RHSA-2026:18059** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18059)\n- **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, … · no fix planned: Logging Subsystem for Red Hat OpenShift, OpenShift Serverless, Red Hat build of Apicurio Registry 2, Red Hat build of Debezium 3, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json)\n- **RHSA-2026:69459** · Red Hat · fixed in: AMQ Clients 2026.Q3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69459)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201609,"id":"CVE-2026-33870","ts":1789399526994,"field":"exploit_available","old":"false","new":"true"},{"seq":200341,"id":"CVE-2026-33870","ts":1789397126833,"field":"exploit_available","old":"true","new":"false"},{"seq":198265,"id":"CVE-2026-33870","ts":1789391772171,"field":"exploit_available","old":"false","new":"true"},{"seq":196058,"id":"CVE-2026-33870","ts":1789383421072,"field":"exploit_available","old":"true","new":"false"},{"seq":194987,"id":"CVE-2026-33870","ts":1789380328278,"field":"exploit_available","old":"false","new":"true"},{"seq":193774,"id":"CVE-2026-33870","ts":1789378287593,"field":"exploit_available","old":"true","new":"false"},{"seq":192561,"id":"CVE-2026-33870","ts":1789376249415,"field":"exploit_available","old":"false","new":"true"},{"seq":191348,"id":"CVE-2026-33870","ts":1789373155558,"field":"exploit_available","old":"true","new":"false"},{"seq":190133,"id":"CVE-2026-33870","ts":1789369140162,"field":"exploit_available","old":"false","new":"true"},{"seq":188920,"id":"CVE-2026-33870","ts":1789368056329,"field":"exploit_available","old":"true","new":"false"},{"seq":187703,"id":"CVE-2026-33870","ts":1789365013546,"field":"exploit_available","old":"false","new":"true"},{"seq":186490,"id":"CVE-2026-33870","ts":1789363031025,"field":"exploit_available","old":"true","new":"false"},{"seq":185276,"id":"CVE-2026-33870","ts":1789360974058,"field":"exploit_available","old":"false","new":"true"},{"seq":184063,"id":"CVE-2026-33870","ts":1789357956999,"field":"exploit_available","old":"true","new":"false"},{"seq":182315,"id":"CVE-2026-33870","ts":1789354112636,"field":"exploit_available","old":"false","new":"true"},{"seq":181108,"id":"CVE-2026-33870","ts":1789352969967,"field":"exploit_available","old":"true","new":"false"},{"seq":179901,"id":"CVE-2026-33870","ts":1789350018003,"field":"exploit_available","old":"false","new":"true"},{"seq":178694,"id":"CVE-2026-33870","ts":1789347846543,"field":"exploit_available","old":"true","new":"false"},{"seq":177487,"id":"CVE-2026-33870","ts":1789346195688,"field":"exploit_available","old":"false","new":"true"},{"seq":176280,"id":"CVE-2026-33870","ts":1789342768658,"field":"exploit_available","old":"true","new":"false"},{"seq":175734,"id":"CVE-2026-33870","ts":1789338579262,"field":"exploit_available","old":"false","new":"true"},{"seq":175604,"id":"CVE-2026-33870","ts":1789338397844,"field":"exploit_available","old":"true","new":"false"},{"seq":174399,"id":"CVE-2026-33870","ts":1789334609085,"field":"exploit_available","old":"false","new":"true"},{"seq":173194,"id":"CVE-2026-33870","ts":1789333224125,"field":"exploit_available","old":"true","new":"false"},{"seq":172008,"id":"CVE-2026-33870","ts":1789330908171,"field":"exploit_available","old":"false","new":"true"},{"seq":170822,"id":"CVE-2026-33870","ts":1789328414186,"field":"exploit_available","old":"true","new":"false"},{"seq":169617,"id":"CVE-2026-33870","ts":1789326930081,"field":"exploit_available","old":"false","new":"true"},{"seq":168412,"id":"CVE-2026-33870","ts":1789323468421,"field":"exploit_available","old":"true","new":"false"},{"seq":167207,"id":"CVE-2026-33870","ts":1789319390923,"field":"exploit_available","old":"false","new":"true"},{"seq":166002,"id":"CVE-2026-33870","ts":1789318321090,"field":"exploit_available","old":"true","new":"false"},{"seq":164797,"id":"CVE-2026-33870","ts":1789315560679,"field":"exploit_available","old":"false","new":"true"},{"seq":163592,"id":"CVE-2026-33870","ts":1789313282197,"field":"exploit_available","old":"true","new":"false"},{"seq":162387,"id":"CVE-2026-33870","ts":1789311728281,"field":"exploit_available","old":"false","new":"true"},{"seq":161182,"id":"CVE-2026-33870","ts":1789308292911,"field":"exploit_available","old":"true","new":"false"},{"seq":160687,"id":"CVE-2026-33870","ts":1789304221801,"field":"exploit_available","old":"false","new":"true"},{"seq":158525,"id":"CVE-2026-33870","ts":1789299309326,"field":"exploit_available","old":"true","new":"false"},{"seq":157489,"id":"CVE-2026-33870","ts":1789296474601,"field":"exploit_available","old":"false","new":"true"},{"seq":156284,"id":"CVE-2026-33870","ts":1789294410291,"field":"exploit_available","old":"true","new":"false"},{"seq":155079,"id":"CVE-2026-33870","ts":1789292652332,"field":"exploit_available","old":"false","new":"true"},{"seq":153874,"id":"CVE-2026-33870","ts":1789289376921,"field":"exploit_available","old":"true","new":"false"},{"seq":153086,"id":"CVE-2026-33870","ts":1789285286208,"field":"exploit_available","old":"false","new":"true"},{"seq":148020,"id":"CVE-2026-33870","ts":1789270893367,"field":"exploit_available","old":"true","new":"false"},{"seq":146060,"id":"CVE-2026-33870","ts":1789269184868,"field":"exploit_available","old":"false","new":"true"},{"seq":144963,"id":"CVE-2026-33870","ts":1789266133636,"field":"exploit_available","old":"true","new":"false"},{"seq":143867,"id":"CVE-2026-33870","ts":1789262454553,"field":"exploit_available","old":"false","new":"true"},{"seq":142703,"id":"CVE-2026-33870","ts":1789261212883,"field":"exploit_available","old":"true","new":"false"},{"seq":141539,"id":"CVE-2026-33870","ts":1789258627251,"field":"exploit_available","old":"false","new":"true"},{"seq":140341,"id":"CVE-2026-33870","ts":1789256432948,"field":"exploit_available","old":"true","new":"false"},{"seq":139143,"id":"CVE-2026-33870","ts":1789254607093,"field":"exploit_available","old":"false","new":"true"},{"seq":137945,"id":"CVE-2026-33870","ts":1789251600148,"field":"exploit_available","old":"true","new":"false"}]}