The vulnerability of the HttpObjectDecoder component in the framework for developing network applications, servers, and client protocols based on Netty allows attackers to compromise the integrity of protected information.

🗓️ 19 Jun 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 8 Views

The HttpObjectDecoder vulnerability in Netty-based frameworks weakens Http request processing and can compromise the integrity of protected information.

Reporter	Title	Published	Views	Family All 135
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an HTTP Request/Response Smuggling Vulnerability in Netty (CVE-2026-50020)	21 Jul 202621:37	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50020)	3 Aug 202608:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (June 2026 - Part 1 of 2)	7 Jul 202607:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	7 Aug 202620:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty (CVE-2026-50010,CVE-2026-50020,CVE-2026-45416 & CVE-2026-44249)	10 Jul 202605:11	–	ibm
Chainguard	CVE-2026-50020 vulnerabilities	16 Jun 202614:16	–	cgr
Circl	CVE-2026-50020	15 Jun 202622:41	–	circl
CVE	CVE-2026-50020	12 Jun 202614:55	–	cve
Cvelist	CVE-2026-50020 Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted	12 Jun 202614:55	–	cvelist

Source	Link
dbugs	www.dbugs.ptsecurity.com/vulnerability/PT-2026-48904
dailycve	www.dailycve.com/netty-http-request-smuggling-cve-2026-50020-moderate-dc-jun2026-455/
github	www.github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c
web	www.web.nvd.nist.gov/view/vuln/detail

19 Jun 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 25

CVSS 35.3

EPSS0.00232

Http Object Decoder Netty Framework Http Request Processing Protected Information Integrity Risk