--- id: CVE-2026-33870 title: 'Netty is an asynchronous, event-driven network application framework' summary: >- Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request s… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N' cwe: - CWE-444 vendor: netty product: netty affected: - netty < 4.1.132 - 'netty >= 4.2.0, < 4.2.10' patched: - netty 4.2.10 published: '2026-03-27' updated: '2026-09-14' sourceUpdated: '2026-09-14T13:18:17.593' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33870' references: - url: 'https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8' label: security-advisories@github.com - url: 'https://w4ke.info/2025/06/18/funky-chunks.html' label: security-advisories@github.com - url: 'https://w4ke.info/2025/10/29/funky-chunks-2.html' label: security-advisories@github.com - url: 'https://www.rfc-editor.org/rfc/rfc9110' label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:10175' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:10184' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:13571' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:14272' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:14276' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:17668' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:17789' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18054' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18055' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18059' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22619' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34608' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65126' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7109' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7380' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:8159' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:8509' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-33870' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2452453' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-33870' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33870' - url: 'https://access.redhat.com/errata/RHSA-2026:69459' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat exploitAvailable: true ssvc: exploitation: poc automatable: 'yes' technicalImpact: partial timestamp: '2026-03-31T13:55:28.970197Z' epss: 0.00698 epssPercentile: 0.51035 ingestedAt: '2026-07-03T14:03:36.911Z' --- ## Overview Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue. ## Affected - `netty < 4.1.132` - `netty >= 4.2.0, < 4.2.10` ## Remediation Upgrade past the affected range: - `netty 4.2.10` ## Vendor advisories - **RHSA-2026:18054** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18054) - **RHSA-2026:17789** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:17789) - **RHSA-2026:18055** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18055) - **RHSA-2026:14276** · Red Hat · fixed in: Red Hat AMQ Broker 7.12.7 · released 2026-05-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:14276) - **RHSA-2026:14272** · Red Hat · fixed in: Red Hat AMQ Broker 7.13.5 · released 2026-05-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:14272) - **RHSA-2026:8509** · Red Hat · fixed in: Red Hat AMQ Broker 7.14.0 · released 2026-04-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:8509) - **RHSA-2026:8159** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · released 2026-04-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:8159) - **RHSA-2026:22619** · Red Hat · fixed in: Red Hat Data Grid 8.6.1 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22619) - **RHSA-2026:18059** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18059) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, … · no fix planned: Logging Subsystem for Red Hat OpenShift, OpenShift Serverless, Red Hat build of Apicurio Registry 2, Red Hat build of Debezium 3, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json) - **RHSA-2026:69459** · Red Hat · fixed in: AMQ Clients 2026.Q3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69459)