CVE-2026-93566

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description An issue exists where strict validation of the chunk-size line is skipped when the line contains no chunk extension (;). A remote attacker can exploit this by sending a specially crafted HTTP request containing control characters, such as an embedded bare CR, within the chunk-size line. This allows the injection of arbitrary HTTP requests, leading to HTTP request smuggling, which may result in unauthorized actions or information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.