CVE-2026-93574

Summary io.netty:netty-codec-http accepts post-digit whitespace inside an HTTP/1.1 chunk-size token, truncates parsing at that whitespace/control byte, and does not validate the remaining bytes on the line. A malformed chunk line such as 5 c\r\n is parsed as size 0x5 instead of being rejected. Th...