CVE-2026-93573

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw in the HTTP/1.1 decoder allows a remote attacker to bypass Transfer-Encoding header validation. By splitting the Transfer-Encoding field across multiple headers and ensuring the last field contains a non-final transfer coding, such as gzip or deflate, an attacker can trigger HTTP request smuggling. This technique allows for the desynchronization of request processing, enabling the bypass of security controls or causing requests to be processed in an unintended context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.