CVE-2026-89044

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.133.Final through 4.1.137.Final Netty versions 4.2.13.Final through 4.2.17.Final

Description Improper validation of the final transfer coding in the Transfer-Encoding header allows attackers to perform request smuggling using malformed encoding declarations. This occurs when attackers split the Transfer-Encoding header across multiple lines or use values such as chunked, xchunked to bypass validation. Consequently, messages may be decoded as chunked even when the final coding is not chunked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.