CVE-2026-50020Medium· 5.3▾ SunlitA flaw was found in Netty. The HttpObjectDecoder component, which processes incoming HTTP requests, incorrectly skips certain control characters and whitespace before reading the first request line. This behavior, which goes beyond standar…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
A flaw was found in Netty. The HttpObjectDecoder component, which processes incoming HTTP requests, incorrectly skips certain control characters and whitespace before reading the first request line. This behavior, which goes beyond standard HTTP protocol requirements, can lead to request-boundary confusion in systems that use pipelined or multiplexed transports. An attacker could exploit this to cause a front-end component to misinterpret HTTP request boundaries, potentially resulting in low integrity impact, such as unintended data manipulation.
netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder — rated Moderate by Red Hat. Released 2026-06-12, updated 2026-09-07.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:50085 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:26018 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:26017
Workarounds / mitigations:
Affected packages:
io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.14.Finalio.netty:netty-codec-http <= 4.1.134.FinalPatched in:
io.netty:netty-codec-http 4.2.15.Finalio.netty:netty-codec-http 4.1.135.FinalConnected by shared product, vendor, weakness, or advisory.
CVE-2026-45673Medium· 6.8netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs (CVE-2026-45673)
CVE-2026-47244Medium· 5.3netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams (CVE-2026-47244)
CVE-2026-50560Medium· 5.3netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling (CVE-2026-50560)
CVE-2026-55851High· 7.5io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)
CVE-2026-93574Medium· 6.5A flaw was found in Netty's `netty-codec-http` component
CVE-2026-93573Medium· 6.5A flaw was found in Netty's HTTP/1.1 decoder