CVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder.
Published Sep 18, 2026 · updated Oct 15, 2026
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass header validation by splitting the field across multiple headers, with the last field containing a non-final transfer coding like or . This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 18, 2026 · NIST NVD
Detected
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass header validation by splitting the field across multiple headers, with the last field containing a non-final transfer coding like or . This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed i
Oct 15, 2026 · NIST NVD
Updated
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass header validation by splitting the field across multiple headers, with the last field containing a non-final transfer coding like or . This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed i
Sources
- CVE.orgVulnerability recordCVE-2026-93573
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass header validation by splitting the field across multiple headers, with the last field containing a non-final transfer coding like or
nvd.nist.gov