Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-67735 EUVD-2025-203450GHSA-84h7-rjj3-6jx4

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Published Dec 16, 2025 · Updated Dec 16, 2025 · Assigned by GitHub_M

Vendor: netty Product: netty Package: akhq Package: apache-activemq-artemis Package: apache-activemq-artemis-compat Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-registry Package: apache-nifi-registry-toolkit Package: apache-nifi-toolkit Package: apicurio-registry Package: celeborn-0.6 Package: docker-selenium-base Package: druid Package: flyway Package: io.netty:netty-codec-http Package: keycloak-26.4-iamguarded-compat Package: kserve-modelmesh Package: kserve-modelmesh-compat Package: management-api-for-apache-cassandra-5.0 Package: management-api-for-apache-cassandra-5.0-compat Package: neo4j-2025.10 Package: neo4j-2025.10-browser Package: neo4j-2025.10-docker-publish Package: netty Package: netty Package: opensearch-2 Package: opensearch-3 Package: opensearch-3-ml-commons Package: opensearch-3-notifications Package: opensearch-3-performance-analyzer Package: opensearch-3-repository-azure Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-security-analytics Package: sonarqube Package: spark-4.0-scala-2.13 Package: spark-4.1 Package: spark-4.1-scala-2.13 Package: spark-4.1-scala-2.13-compat Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: wavefront-proxy Package: wavefront-proxy-compat Package: wavefront-proxy-config Package: wavefront-proxy-licenses Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Package: zipkin Package: zipkin-oci-entrypoint Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Affected products

VendorProductAffectedFixed
netty netty >= 4.2.0.Alpha1, < 4.2.8.Final, < 4.1.129.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty 1:4.1.48-16 —
Debian 13 netty 1:4.1.48-10+deb13u1 DSA-6160-1
Debian 12 netty 1:4.1.48-7+deb12u2 DSA-6160-1
Debian 11 netty 1:4.1.48-4+deb11u3 DLA-4519-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Ubuntu 25.10 netty No fix yet —
Ubuntu 24.04 LTS netty 1:4.1.48-9ubuntu0.2 USN-8654-1
Ubuntu 22.04 LTS netty 1:4.1.48-4+deb11u2ubuntu0.2 USN-8654-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS netty 1:4.1.48-9ubuntu0.2+esm1 —
Ubuntu Pro 22.04 LTS netty 1:4.1.48-4+deb11u2ubuntu0.2+esm1 —
Ubuntu Pro 20.04 LTS netty 1:4.1.45-1ubuntu0.1~esm7 USN-8654-1
Ubuntu Pro 18.04 LTS netty 1:4.1.7-4ubuntu0.1+esm7 USN-8654-1
Ubuntu Pro 16.04 LTS netty 1:4.0.34-1ubuntu0.1~esm5 USN-8654-1
Ubuntu Pro 14.04 LTS netty No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.130-150200.4.40.1 SUSE-SU-2025:4489-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.130-1.1 openSUSE-SU-2025:15824-1
openSUSE Leap 15.6 netty 4.1.130-150200.4.40.1 SUSE-SU-2025:4489-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.26.0-r4 —
Wolfi rolling apache-activemq-artemis +1 2.44.0-r1 —
Wolfi rolling apache-nifi +4 2.7.2-r0 —
Wolfi rolling apicurio-registry 3.1.4-r3 —
Wolfi rolling celeborn-0.6 0.6.2-r6 —
Wolfi rolling docker-selenium-base 4.39.0.20251202-r1 —
Wolfi rolling druid 35.0.1-r1 —
Wolfi rolling flyway 11.19.0-r1 —
Wolfi rolling keycloak-26.4-iamguarded-compat 26.4.7-r1 —
Wolfi rolling kserve-modelmesh +1 0.12.0-r19 —
Wolfi rolling management-api-for-apache-cassandra-5.0 +1 0.1.111-r1 —
Wolfi rolling neo4j-2025.10 No fix yet —
Wolfi rolling neo4j-2025.10-browser +1 2025.10.1-r2 —
Wolfi rolling opensearch-2 2.19.4-r3 —
Wolfi rolling opensearch-3 +2 3.4.0-r0 —
Wolfi rolling opensearch-3-security +4 3.5.0-r0 —
Wolfi rolling sonarqube 25.12.0.117093-r1 —
Wolfi rolling spark-4.0-scala-2.13 4.0.1-r3 —
Wolfi rolling spark-4.1 +2 4.1.0-r1 —
Wolfi rolling strimzi-kafka-operator-kafka-init +5 0.49.1-r4 —
Wolfi rolling strimzi-kafka-operator-kafka-thirdparty-libs-cc 0.51.0-r0 —
Wolfi rolling tez 0.10.5-r10 —
Wolfi rolling thingsboard-tb-node +1 4.2.1-r9 —
Wolfi rolling trino +57 479-r1 —
Wolfi rolling wavefront-proxy +3 13.9-r1 —
Wolfi rolling wildfly-openjdk-17 +1 38.0.1-r1 —
Wolfi rolling zipkin +2 3.5.1-r9 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-http >= 4.2.0.Alpha1, < 4.2.8.Final 4.2.8.Final GHSA-84h7-rjj3-6jx4
Maven io.netty:netty-codec-http < 4.1.129.Final 4.1.129.Final GHSA-84h7-rjj3-6jx4

Advisories 10

References