{"id":"CVE-2026-89044","title":"Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encod…","summary":"Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encod…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-444"],"vendor":"netty","product":"netty","affected":["netty >= 4.1.133, < 4.1.138","netty >= 4.2.13, < 4.2.18"],"patched":["netty 4.2.18"],"published":"2026-09-10","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:39.213","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89044","references":[{"url":"https://github.com/netty/netty","label":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/blob/netty-4.1.137.Final/codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java#L866","label":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/commit/640d4d3324f7b811a4903d0730c8ccb35500500c","label":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/commit/ca87393b0e9e13c493d213a268e727a6d44e1585","label":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","label":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.18.Final","label":"disclosure@vulncheck.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netty-4.1.133-final-through-4.1.137-final-and-4.2.13-final-through-4.2.17-final-http-request-smuggling-via-transfer-encoding","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00243,"epssPercentile":0.15747,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-18T17:11:17.626681Z"},"ingestedAt":"2026-09-12T14:36:59.336Z","slug":"CVE-2026-89044","body":"## Overview\n\nNetty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.\n\n## Affected\n\n- `netty >= 4.1.133, < 4.1.138`\n- `netty >= 4.2.13, < 4.2.18`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `netty 4.2.18`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}