netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection

A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a DefaultHttpRequest or DefaultFullHttpRequest is created. This vulnerability, a form of Carriage Return Line Feed CRLF injection, allows for the insertion of additional HTTP or RTSP...

UBUNTU-CVE-2026-41417

Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. The constructors reject CRLF and whitespace characters that would break the start-line, but setUri does not apply the same validation...