The vulnerability of the DefaultHttpRequest and DefaultFullHttpRequest classes in the Netty framework for developing network applications, servers, and client protocols allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

🗓️ 14 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Netty DefaultHttpRequest and DefaultFullHttpRequest processing flaws enable HTTP Request Smuggling.

Reporter	Title	Published	Views	Family All 173
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.132.Final.jar	18 May 202619:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server	29 Jul 202613:02	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in netty-codec-http-4.1.132.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-41417)	29 May 202609:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to CRLF Injection due to Netty ( CVE-2026-41417 )	11 Jun 202616:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities	9 Jul 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could lead to HTTP request smuggling, desynchronization, or RTSP request injection.(CVE-2026-41417).	3 Aug 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® is affected by a vulnerability in netty-codec-http-4.1.130.Final.jar (CVE-2026-41417)	10 Jul 202618:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM DevOps Build.	29 Jun 202615:52	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.	5 Aug 202610:08	–	ibm

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv
web	www.web.nvd.nist.gov/view/vuln/detail

14 Jul 2026 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25

CVSS 35.3

EPSS0.00307

netty framework http request smuggling default http request http request processing