Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected products
netty: netty
References2
- github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 ExploitVendor Advisory
- github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 ExploitVendor Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - EPSS — exploit probability
- 0% percentile: 32 · as of 14 November 2026
- CWE
- CWE-190CWE-444
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.