PT-2026-89523

CVE-2026-89044

Published

2026-09-10

Updated

2026-10-30

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.133.Final through 4.1.137.Final Netty versions 4.2.13.Final through 4.2.17.Final

Description Improper validation of the final transfer coding in the Transfer-Encoding header allows attackers to perform request smuggling using malformed encoding declarations. This occurs when attackers split the Transfer-Encoding header across multiple lines or use values such as chunked, xchunked to bypass validation. Consequently, messages may be decoded as chunked even when the final coding is not chunked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Dreamlike-Ocean

Michael-Jread

Vendors

Affected products

Weakness enumeration

CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')

Related identifiers