Fluid Attacks Database

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	netty	=1:4.1.48-10 \|\| =1:4.1.48-10+deb13u1 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-
debian 12	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16 \|\| =1:4.1.48-7 \|\| =1:4.1.48-7+deb12u1 \|\| =1:4.1.48-7+deb12u2 \|\| =1:4.1.48-8 \|\| =1:4.1.48-9	-
debian 14	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-
maven	io.netty:netty-codec-http	>=0 <4.1.132.final \|\| >=4.2.0.alpha1 <4.2.10.final	4.1.132.final, 4.2.10.final

Aliases

1. CVE-2026-338702. NVD-2026-338703. OSV-DEBIAN-2026-338704. OSV-2026-338705. GHSA-pwqr-wmgm-9rr86. GCVE-2026-338707. SECURITY-TRACKER-CVE-2026-33870

References

1. https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr82. https://w4ke.info/2025/06/18/funky-chunks.html3. https://w4ke.info/2025/10/29/funky-chunks-2.html4. https://www.rfc-editor.org/rfc/rfc9110

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.