AIKIDO-2026-179204

netty-codec-http is vulnerable to HTTP Request Smuggling

HTTP Request SmugglingGHSA-2g6j-r8q9-5hr8 Published Yesterday

High Risk

This Affects:

netty-codec-http

4.1.0.Final - 4.1.136.Final

Fixed in 4.1.137.Final

4.2.0.Final - 4.2.16.Final

Fixed in 4.2.17.Final

Are you affected? Scan for Free

TL;DR

HttpServerCodec pairs each outbound response to a request by polling the recorded request method, including for 1xx interim responses. When pipelined GET and HEAD requests are combined with a client sending Expect: 100-continue, responses are mismatched to requests: the HEAD response body is dropped while the GET body is sent under HEAD's headers. The connection is left desynchronized and unsafe for further pipelined traffic, enabling response splitting and smuggling. The fix stops 1xx responses from consuming the request-method mapping.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your server handles pipelined HTTP/1.1 requests where clients can send an Expect: 100-continue header.