CVE-2025-67735: 
Java vulnerability analysis and mitigation

CVE-2025-67735 is a CRLF injection vulnerability in Netty's io.netty.handler.codec.http.HttpRequestEncoder that enables HTTP request smuggling by injecting carriage return and line feed characters into the request URI during HTTP request construction. It affects Netty versions prior to 4.1.129.Final (all 4.1.x releases) and prior to 4.2.8.Final (4.2.0 through 4.2.7.Final). The vulnerability was disclosed on December 15, 2025, via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is improper neutralization of CRLF sequences (CWE-93) in HttpRequestEncoder, which UTF-8 encodes the URI directly without sanitizing for line-break characters (\r or \n): buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8). In contrast, the HTTP headers implementation already guards against this via a validator. An unauthenticated remote attacker can craft a DefaultHttpRequest with a URI containing embedded CRLF sequences and additional HTTP request lines, causing the encoder to emit a malformed byte stream that a downstream server or proxy interprets as multiple distinct HTTP requests. The fix, applied in commit 77e81f1, adds a validateRequestLineTokens() check in DefaultHttpRequest that throws IllegalArgumentException if the URI contains \n, \r, or space characters (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated network attacker to perform HTTP request smuggling, potentially bypassing security controls such as WAFs or reverse proxies, manipulating request routing, and injecting unauthorized requests into backend systems. The confidentiality and integrity impacts are rated Low — an attacker may be able to read or modify limited data by poisoning shared HTTP connections or cache entries. Availability is not directly impacted. The broad adoption of Netty as a foundational networking library means the vulnerability affects a wide range of downstream products, including IBM Cloud Pak for Automation, IBM Event Processing, IBM SPSS Analytic Server, IBM Guardium Data Security Center, Splunk AppDynamics agents, Oracle Database products, Keycloak, Quarkus, Eclipse Vert.x, and others (GitHub Advisory, IBM Advisory).

1. Identify a vulnerable target: Locate applications or services built on Netty versions prior to 4.1.129.Final or 4.2.8.Final that use HttpRequestEncoder (or HttpClientCodec) to construct outbound HTTP requests — for example, reverse proxies, API gateways, or microservices acting as HTTP clients.
2. Craft a malicious URI: Construct an HTTP request URI containing embedded CRLF sequences followed by a complete secondary HTTP request, e.g.: /s1 HTTP/1.1\r\n\r\nPOST /s2 HTTP/1.1\r\ncontent-length: 11\r\n\r\nHello WorldGET /s1.
3. Inject via the application: Supply this crafted URI as input to the vulnerable Netty-based client (e.g., through a user-controlled parameter that is passed to DefaultHttpRequest without sanitization).
4. Trigger encoding: When HttpRequestEncoder encodes the request, it writes the URI verbatim into the byte stream, embedding the injected CRLF sequences and secondary request.
5. Achieve request smuggling: The downstream server or proxy parses the byte stream as two separate HTTP requests — the legitimate first request and the attacker-injected second request — potentially routing the injected request to a backend endpoint, bypassing access controls, or poisoning shared connection state (GitHub Advisory, Fix Commit).

• Network: Outbound HTTP requests from Netty-based services containing raw \r\n sequences within the URI portion of the request line; unexpected secondary HTTP requests appearing in backend server access logs originating from a single upstream connection.
• Logs: Backend or proxy access logs showing requests to unexpected endpoints (e.g., /s2, /admin) with source IPs matching the Netty-based intermediary; HTTP parsing errors or desynchronization warnings in proxy or load balancer logs.
• Application: IllegalArgumentException messages referencing "URI contain illegal characters" in application logs after upgrading to patched Netty versions — indicating prior exploitation attempts that are now being blocked.

Upgrade Netty to version 4.1.129.Final or later (for 4.1.x users) or 4.2.8.Final or later (for 4.2.x users), which add URI validation in DefaultHttpRequest that rejects line-break and space characters with an IllegalArgumentException (GitHub Advisory). As a temporary workaround if upgrading is not immediately possible, implement application-level sanitization of all user-supplied URIs before passing them to HttpRequestEncoder, rejecting or stripping any \r, \n, or space characters. Downstream product users should apply vendor-specific patches: Oracle CPU January 2026 and April 2026 (Oracle Jan 2026, Oracle Apr 2026), Splunk AppDynamics Machine/Database Agent March 2026 updates, and IBM product iFixes as published in their respective security bulletins (IBM Advisory).

The Netty maintainer normanmaurer published the advisory on December 15, 2025, and the fix was contributed by chrisvest and merged promptly. The vulnerability was noted in the Java community news roundup for December 15, 2025, on InfoQ and tech blogs. Eclipse Vert.x released version 4.5.23 incorporating the fix, and Quarkus released versions 3.20.5 and 3.27.2 addressing the issue. Keycloak 26.5.2 also incorporated the patched Netty version. Community discussion on Stack Overflow highlighted the impact on frameworks like Karate that bundle affected Netty versions (GitHub Advisory).