CVE-2025-67735Medium· 6.5▾ SunlitNetty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the URI. Any application / framework using HttpRequestEncoder can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
netty < 4.1.129netty >= 4.2.0, < 4.2.8Upgrade past the affected range:
netty 4.2.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42578High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2021-43797Medium· 6.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients
CVE-2021-37136High· 7.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)
CVE-2021-37137High· 7.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage
CVE-2021-21409Medium· 5.9Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients
CVE-2021-21295Medium· 5.9Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients