CVE catalog

CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP r

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannettysid1:4.1.48-16vulnerable
Debiannettyforky1:4.1.48-16vulnerable
Debiannettytrixie1:4.1.48-10+deb13u1vulnerable
Debiannettytrixie-security1:4.1.48-10+deb13u1vulnerable
Debiannettybookworm1:4.1.48-7+deb12u2vulnerable
Debiannettybookworm-security1:4.1.48-7+deb12u2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannettysourcesid(unfixed)not yet assignedNot reported[1148396]
Debiannettysourceforky(unfixed)not yet assignedNot reported[1148396]
Debiannettysourcetrixie(unfixed)not yet assignedNot reported[1148396]
Debiannettysourcebookworm(unfixed)not yet assignedNot reported[1148396]

[Debian bug #1148396]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnetty-java]Affected

    Source package: [netty]

    Details (4)

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Affected

      nvd · netty · debian · bookworm

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Affected

      nvd · netty · debian · bookworm

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Affected

      nvd · netty · debian · bookworm

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Affected

      nvd · netty · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]