CLEANSTART-2026-LP38046 Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`

CVE-2026-41417 affects multiple packages. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. See references for individual vulnerability details...

CLEANSTART-2026-VG48638 Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`

CVE-2026-41417 affects multiple packages. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. See references for individual vulnerability details...

CLEANSTART-2026-DD24973 Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`

CVE-2026-41417 affects multiple packages. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. See references for individual vulnerability details...

CLEANSTART-2026-FP29744 Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`

Security vulnerability affects the sonarqube package. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri...

CLEANSTART-2026-VY95094 Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri...

PT-2026-108559

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri...

netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection

A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a DefaultHttpRequest or DefaultFullHttpRequest is created. This vulnerability, a form of Carriage Return Line Feed CRLF injection, allows for the insertion of additional HTTP or RTSP...

UBUNTU-CVE-2026-41417

Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. The constructors reject CRLF and whitespace characters that would break the start-line, but setUri does not apply the same validation...

CVE-2026-41417

Netty allows request-line validation to be bypassed when a "DefaultHttpRequest" or "DefaultFullHttpRequest" is created first and its URI is later changed via "setUri". The constructors reject CRLF and whitespace characters that would break the start-line, but "setUri" does not apply the same...