Vulnerabilities

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to correctly validate the final transfer coding in the HTTP Transfer-Encoding header (CWE-444, inconsistent interpretation of HTTP requests). An attacker triggers the flaw by sending a request whose Transfer-Encoding header is split across multiple lines or contains malformed values such as 'chunked, xchunked', causing Netty to decode the message as chunked even though the final coding is not chunked. This creates a desynchronization between front-end proxies and the Netty-based backend, enabling request smuggling that can bypass access controls, poison caches, or interfere with other users' requests (low confidentiality and integrity impact per the CVSS 4.0 score of 6.9). Any application or product embedding an affected Netty version is affected, including consumers of frameworks and servers that bundle Netty. Exploitation has not been confirmed in the wild (not in CISA KEV, EPSS 0.2%), but the technique is publicly documented in the vendor advisory GHSA-hcvj-94mj-jp5c.

Do: Upgrade Netty to the first release after 4.1.137.Final on the 4.1 branch and after 4.2.17.Final on the 4.2 branch (fixed versions are listed in advisory GHSA-hcvj-94mj-jp5c), and audit transitive dependencies with 'mvn dependency:tree' or 'gradle dependencies' since most exposure comes via frameworks that bundle Netty. Until patched, configure any front-end proxy in front of Netty services to reject ambiguous Transfer-Encoding headers (duplicated, split across lines, or containing unrecognized codings) so the proxy and backend cannot desync.