CVE-2026-93574

A flaw was found in Netty's component.

Published Sep 18, 2026 · updated Oct 15, 2026

A flaw was found in Netty's component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Sep 18, 2026 · NIST NVD
Detected
A flaw was found in Netty's component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
Oct 15, 2026 · NIST NVD
Updated
A flaw was found in Netty's component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.

Sources

CVE.orgVulnerability recordCVE-2026-93574
Official CVE identifier
cve.org
NIST NVDVulnerability recordCVE-2026-93574
A flaw was found in Netty's component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling.
nvd.nist.gov