A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Red Hat
  • Red Hat Amq Broker 7
Redhat
  • Amq Broker
  • Amq Clients
  • Apicurio Registry
  • Build Keycloak
  • Build Of Apache Camel For Quarkus
  • Build Of Apache Camel For Spring Boot
  • Build Of Apicurio Registry
  • Build Of Debezium 3
  • Build Of Keycloak
  • Build Of Quarkus
  • Camel Quarkus
  • Camel Spring Boot
  • Data Grid 8
  • Debezium
  • Jboss Data Grid
  • Jboss Enterprise Application Platform
  • Jboss Fuse
  • Quarkus
  • Quay 3
  • Red Hat Single Sign On
  • Single Sign-on

No data.

No data.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:69440 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:69470 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:83612 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-93566 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2536954 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-93566 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-93566 cve-icon
History

Thu, 15 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:debezium:3 cpe:/a:redhat:debezium:3.6
References

Fri, 09 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat quarkus
CPEs cpe:/a:redhat:quarkus:3.27::el8
cpe:/a:redhat:quarkus:3.33::el8
Vendors & Products Redhat quarkus

Thu, 24 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
References

Mon, 21 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Red Hat
Red Hat red Hat Amq Broker 7
Redhat build Of Apache Camel For Quarkus
Redhat build Of Apache Camel For Spring Boot
Redhat build Of Apicurio Registry
Redhat build Of Debezium 3
Redhat build Of Keycloak
Redhat build Of Quarkus
Redhat data Grid 8
Redhat quay 3
Redhat single Sign-on
Vendors & Products Red Hat
Red Hat red Hat Amq Broker 7
Redhat build Of Apache Camel For Quarkus
Redhat build Of Apache Camel For Spring Boot
Redhat build Of Apicurio Registry
Redhat build Of Debezium 3
Redhat build Of Keycloak
Redhat build Of Quarkus
Redhat data Grid 8
Redhat quay 3
Redhat single Sign-on

Mon, 21 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:quarkus:3
Vendors & Products Redhat quarkus
References

Sat, 19 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Fri, 18 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch
Title Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
First Time appeared Redhat
Redhat amq Broker
Redhat amq Clients
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat camel Spring Boot
Redhat debezium
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat quarkus
Redhat red Hat Single Sign On
Weaknesses CWE-1035
CPEs cpe:/a:redhat:amq_broker:7
cpe:/a:redhat:amq_clients:2023
cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:debezium:3
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat amq Broker
Redhat amq Clients
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat camel Spring Boot
Redhat debezium
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat quarkus
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-09-18T14:19:29.741Z

Updated: 2026-10-15T17:01:19.077Z

Reserved: 2026-09-18T10:00:52.431Z

Link: CVE-2026-93566

cve-icon Vulnrichment

Updated: 2026-09-22T14:28:35.539Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-18T15:17:20.290

Modified: 2026-10-15T17:17:31.093

Link: CVE-2026-93566

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-10T00:47:37Z

Links: CVE-2026-93566 - Bugzilla