CVE-2025-67735
Netty is an asynchronous, event-driven network application framework.
Published Dec 16, 2025 · updated Oct 14, 2026 · netty netty
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when is used without proper sanitization of the URI. Any application / framework using can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
Timeline
Detection, updates, and resolution for this record.
Dec 16, 2025 · NIST NVD
Detected
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when is used without proper sanitization of the URI. Any application / framework using can be subject to be abused to perform request smuggling using CRLF injection. Versi
Oct 14, 2026 · NIST NVD
Updated
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when is used without proper sanitization of the URI. Any application / framework using can be subject to be abused to perform request smuggling using CRLF injection. Versi
Affected
- cpe netty/nettyversion unspecified
Sources
- CVE.orgCVE-2025-67735
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-67735
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2025-67735
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the has a CRLF injection with the request URI when constructing a request. This leads to request smuggling wh
nvd.nist.gov