> CVE-2026-89044 [MEDIUM]

« BACK_TO_HOME
PUBLISHED
2026-09-10 18:18
MODIFIED
2026-09-10 18:18
CVSS_SCORE V3
6.9
EPSS (Prob. Exploit)
0.28%
Top 80.4%
DATA SOURCES:
NVD đź”— 2026-09-10 CWE MITRE đź”— 2026-10-01 FIRST EPSS đź”— 2026-10-18 OSV đź”— 2026-10-26

> DESCRIPTION

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
None (N)
Aucune authentification requise
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
Low (L)
Divulgation limitée d'informations
I (Impact Intégrité)
Integrity Impact
Low (L)
Modification limitée des données possible
A (Impact Disponibilité)
Availability Impact
None (N)
Aucune interruption de service

> RÉSUMÉ DES IMPACTS

Confidentialité
Low
Divulgation limitée d'informations
Intégrité
Low
Modification limitée des données possible
Disponibilité
None
Aucune interruption de service

> WEAKNESSES

CWE-444

> CWE DETAILED DESCRIPTIONS

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') - The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

AFFECTED PACKAGES:
Unknown / Unknown
11 versions affected
ALIASES:
GHSA-hcvj-94mj-jp5c

> HISTORIQUE DES MODIFICATIONS

Première apparition
10/09/2026 18:18
Source: NVD
đź“Š ENRICHISSEMENT 01/10/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') - The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow betwe...
Total des modifications: 1 Dernière mise à jour: 3 weeks ago

> REFERENCES

https://github.com/netty/netty
https://github.com/netty/netty/blob/netty-4.1.137.Final/codec-http/src/main/java...
https://github.com/netty/netty/commit/640d4d3324f7b811a4903d0730c8ccb35500500c
https://github.com/netty/netty/commit/ca87393b0e9e13c493d213a268e727a6d44e1585
https://github.com/netty/netty/releases/tag/netty-4.1.138.Final
https://github.com/netty/netty/releases/tag/netty-4.2.18.Final
https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c
https://www.vulncheck.com/advisories/netty-4.1.133-final-through-4.1.137-final-a...
« BACK_TO_HOME