Security Bulletin: IBM Event Processing is vulnerable to a CRLF injection vulnerability in Netty (CVE-2025-67735)

Summary IBM Event Processing is vulnerable to a CRLF injection vulnerability in Netty io.netty.handler.codec.http.HttpRequestEncoder. An attacker could exploit this vulnerability to perform HTTP request smuggling against affected Event Processing services that use the vulnerable Netty component...

CVE-2026-41417: Improper Neutralization of CRLF Sequences

Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. The constructors reject CRLF and whitespace characters that would break the start-line, but setUri does not apply the same validation...

ROS-20260216-73-0011

A vulnerability in the io.netty.handler.codec.http.HttpRequestEncoder component of the Netty networking tool is related to the failure to take measures to neutralize CRLF sequences when processing the HttpRequestEncoder parameter. Exploitation of the vulnerability could allow an attacker acting...

The vulnerability of the io.netty.handler.codec.http.HttpRequestEncoder component in the Netty networking framework allows a attacker to replace the URL address.

The vulnerability of the io.netty.handler.codec.http.HttpRequestEncoder component in the Netty networking framework is related to the failure to handle CRLF sequences when processing the HttpRequestEncoder parameter. Exploiting this vulnerability allows a remote attacker to replace the URL addres...

CVE-2025-67735

CVE-2025-67735 : Netty has a CRLF injection in io.netty.handler.codec.http.HttpRequestEncoder that can enable request smuggling when the URI is not sanitized. Affected versions are prior to 4.1.129.Final and 4.2.8.Final; these versions are stated as having fixes. The vulnerability arises from CRL...

CVE-2025-67735: Improper Neutralization of CRLF Sequences

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when HttpRequestEncod...

Netty 注入漏洞

Netty is a non-blocking I/O client-server framework from the Netty community, which is primarily used to develop Java web applications such as protocol servers and clients. An injection vulnerability exists in Netty versions prior to 4.1.129.Final and prior to 4.2.8.Final, which stems from a CRLF...

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Summary The io.netty.handler.codec.http.HttpRequestEncoder CRLF injection with the request uri when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the uri. Details The HttpRequestEncoder simply UTF8 encodes the uri without...

PT-2025-51352

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.129.Final Netty versions prior to 4.2.8.Final Description Netty is an asynchronous, event-driven network application framework. The io.netty.handler.codec.http.HttpRequestEncoder is susceptible to a CRLF injection...