CVE-2026-89044Medium· 6.5▾ SunlitNetty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encod…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.
netty >= 4.1.133, < 4.1.138netty >= 4.2.13, < 4.2.18Upgrade past the affected range:
netty 4.2.18Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42584High· 7.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42581Medium· 5.8Netty is an asynchronous, event-driven network application framework
CVE-2026-33870High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-59903Medium· 6.5Netty is an asynchronous, event-driven network application framework
CVE-2026-44248Medium· 5.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42579High· 7.5Netty is an asynchronous, event-driven network application framework