Description
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netty | netty | < 4.1.132.Final, >= 4.2.0.Alpha1, < 4.2.10.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | No fix yet | — |
| Debian 13 | netty | No fix yet | — |
| Debian 12 | netty | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | netty | No fix yet | — |
| Ubuntu 25.10 | netty | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 24.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 22.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 20.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 18.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 14.04 LTS | netty | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-6.redhat_00012.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus +1 | 2.0.5-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-angus-activation | 2.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.84.0-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.6.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-3.jre_redhat_00004.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-guava-failureaccess | 1.0.3-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.7.19-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.48-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-hibernate-search +6 | 7.2.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.4-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jboss-metadata +5 | 16.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.132-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-plexus-utils | 3.6.1-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava | 3.1.12-1.redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava2 | 2.2.21-5.redhat_00003.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.6-5.GA_redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-client-config | 1.0.1-4.Final_redhat_00002.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.1.4-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-10.GA_redhat_00017.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl +1 | 2.3.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el8-x86_64 | 2.3.0-1.Final.redhat.00001.1.el8eap | RHSA-2026:18054 |
| Red Hat JBoss EAP 8 | eap8-wildfly-openssl-el9-x86_64 | 2.3.0-1.Final_redhat_00001.1.el9eap | RHSA-2026:18055 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.4-5.redhat_00007.1.el8eap | RHSA-2026:18055, RHSA-2026:18054 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | netty | 4.1.132-150200.4.43.1 | SUSE-SU-2026:1353-1 |
| SLES 15 SP7 | netty-tcnative | 2.0.75-150200.3.36.1 | SUSE-SU-2026:1353-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.132-1.1 | openSUSE-SU-2026:10463-1 |
| openSUSE Leap 15.6 | netty | 4.1.132-150200.4.43.1 | SUSE-SU-2026:1353-1 |
| openSUSE Leap 15.6 | netty-tcnative | 2.0.75-150200.3.36.1 | SUSE-SU-2026:1353-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.27.0-r0 | — |
| Wolfi rolling | apache-activemq-artemis | 2.53.0-r4 | — |
| Wolfi rolling | apache-pulsar-4.2 | 4.2.1-r0 | — |
| Wolfi rolling | apicurio-registry | 3.2.0-r2 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.2-r9 | — |
| Wolfi rolling | druid | 36.0.0-r11 | — |
| Wolfi rolling | flyway | 12.2.0-r1 | — |
| Wolfi rolling | infinispan-16.1 | 16.1.2-r1 | — |
| Wolfi rolling | keycloak-26.5 +2 | 26.5.6-r2 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r33 | — |
| Wolfi rolling | logstash-9.3 +2 | 9.3.3-r0 | — |
| Wolfi rolling | management-api-for-apache-cassandra-5.0 | 0.1.114-r1 | — |
| Wolfi rolling | neo4j-2025.10 +2 | No fix yet | — |
| Wolfi rolling | opensearch-2 | 2.19.4-r13 | — |
| Wolfi rolling | opensearch-3 +6 | 3.5.0-r3 | — |
| Wolfi rolling | opensearch-3-security-analytics | 3.6.0-r0 | — |
| Wolfi rolling | sonarqube | 26.7.0.124771-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r9 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.1-r10 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-init +5 | 0.51.0-r6 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 0.51.0-r7 | — |
| Wolfi rolling | tez | 0.10.5-r10 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1-r4 | — |
| Wolfi rolling | trino-plugin-hive +12 | 480-r1 | — |
| Wolfi rolling | wavefront-proxy | 13.9-r11 | — |
| Wolfi rolling | wildfly-openjdk-17 +1 | 39.0.1-r2 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty-codec-http | < 4.1.132.Final | 4.1.132.Final | GHSA-pwqr-wmgm-9rr8 |
| Maven | io.netty:netty-codec-http | >= 4.2.0.Alpha1, < 4.2.10.Final | 4.2.10.Final | GHSA-pwqr-wmgm-9rr8 |
Advisories 11
- RHSA-2026:18055 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:18054 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-0846 Netty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- WID-SEC-2026-1229 Atlassian Bamboo, Bitbucket, Confluence, Jira: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 2, 2026
- WID-SEC-2026-2260 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026
- WID-SEC-2026-1198 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- SUSE-SU-2026:1353-1 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Apr 16, 2026
- openSUSE-SU-2026:10463-1 netty-4.1.132-1.1 on GA media SUSE / openSUSE Security Updates · Mar 31, 2026