CVE-2026-93574: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-93574 is an HTTP request smuggling vulnerability in Netty's netty-codec-http component, caused by incorrect parsing of HTTP/1.1 chunk-size tokens that include post-digit whitespace. A remote, unauthenticated attacker can exploit this flaw to smuggle HTTP requests past proxies and backend systems, potentially bypassing security controls or accessing unauthorized resources. The vulnerability was disclosed on September 18, 2026, and affects io.netty:netty-codec-http versions 4.2.13.Final through 4.2.17.Final and 4.1.90.Final through 4.1.137.Final. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). Netty's HttpRequestDecoder accepts post-digit whitespace inside an HTTP/1.1 chunk-size token, truncates parsing at the whitespace or control byte, and does not validate the remaining bytes on the line. For example, a malformed chunk line such as 5 c\r\n is parsed as size 0x5 instead of being rejected, allowing the attacker to embed a second HTTP request (e.g., GET /smuggled) within the body of the first. The flaw is exploitable with no authentication or user interaction required, and a proof-of-concept using Netty's EmbeddedChannel and HttpRequestDecoder was included in the original security advisory (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation enables HTTP request smuggling in proxy/backend deployments where Netty acts as an intermediary. An attacker can desynchronize the request pipeline between Netty and other HTTP components, potentially bypassing firewalls, WAFs, or authentication controls, and accessing unauthorized backend resources. The CVSS assessment reflects low integrity and low availability impact with no direct confidentiality impact; however, in complex proxy chains, the practical impact could include web cache poisoning, unauthorized access to privileged endpoints, or partial denial of service (Red Hat Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no evidence of public exploit code or in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. A proof-of-concept was included in the original GitHub Security Advisory (GHSA-j4mg-hqgv-34qc) submitted to Netty maintainers, but it is not publicly weaponized. No threat actor attribution has been reported (GitHub Advisory, Red Hat Advisory).

1. Reconnaissance: Identify services using Netty's netty-codec-http in versions 4.2.13.Final–4.2.17.Final or 4.1.90.Final–4.1.137.Final, particularly those deployed behind proxies or load balancers that forward HTTP/1.1 traffic.
2. Craft malformed chunked request: Construct an HTTP/1.1 POST request using Transfer-Encoding: chunked with a malformed chunk-size line containing post-digit whitespace, such as 5 c\r\n instead of 5\r\n.
3. Embed smuggled request: Append a second HTTP request (e.g., GET /smuggled HTTP/1.1\r\nHost: example\r\n\r\n) after the malformed chunk body within the same TCP connection.
4. Send to target: Transmit the crafted request to the Netty-based server or proxy. Netty parses the chunk size as 0x5, consuming only the first 5 bytes of the body, and then interprets the remaining bytes as a new, separate HTTP request.
5. Achieve objective: The smuggled request is processed by the backend as a legitimate second request, potentially bypassing authentication, accessing restricted endpoints, or poisoning shared caches (Red Hat Bugzilla).

• Network: HTTP/1.1 POST requests with Transfer-Encoding: chunked headers where chunk-size lines contain embedded whitespace or non-hex characters (e.g., 5 c\r\n); unexpected secondary HTTP requests appearing in backend access logs originating from a single upstream connection.
• Logs: Backend server logs showing requests to sensitive or internal endpoints (e.g., /admin, /internal, /smuggled) with no corresponding entry in the frontend proxy logs; Netty application logs showing unusual chunked body parsing or decoder state transitions.
• Application Behavior: Unexpected HTTP responses returned to clients that do not match the request they sent; cache entries for privileged URLs being served to unprivileged users, indicating potential cache poisoning.

The primary remediation is to update io.netty:netty-codec-http to a fixed version as detailed in the Netty security advisory GHSA-j4mg-hqgv-34qc. The fix involves rejecting internal whitespace and control characters within the chunk-size token during HTTP/1.1 parsing. As interim mitigations, operators should implement strict HTTP request validation at the proxy layer, deploy WAF rules to detect and block requests with malformed chunk-size lines, and monitor for anomalous chunked transfer encoding patterns. Red Hat products consuming the affected component should follow Red Hat's remediation guidance as patches become available (Red Hat Advisory, GitHub Advisory).

Red Hat classified this as a Moderate severity flaw and published a detailed advisory noting that the desynchronization between Netty and other HTTP components in the request path is the primary risk vector in proxy/backend deployments. The vulnerability was reported via Netty's coordinated disclosure process and cross-referenced with several prior Netty HTTP smuggling advisories (GHSA-m4cv-j2px-7723, GHSA-hvcg-qmg6-jm4c, GHSA-v8h7-rr48-vmmv), highlighting a pattern of chunk-parsing weaknesses in the library. Community discussion has been limited, with the CVE appearing in automated tracking feeds shortly after disclosure (Red Hat Advisory, Red Hat Bugzilla).