CVE-2026-89044

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89044
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89044.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89044
Aliases
  • GHSA-hcvj-94mj-jp5c
Downstream
Published
2026-09-10T17:39:34Z
Modified
2026-09-11T11:47:12Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
Details

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89044.json"
}
References

Affected packages

Git / github.com/netty/netty

Affected ranges

Type
GIT
Repo
https://github.com/netty/netty
Events
Introduced
fb13125f135ab53203513ff603872a3abe84d38d
Fixed
26e68a2c3935e459b374891c87760f6d6c5e2550
Introduced
b3844c8108b42f68d56144b36d4d1ed96078a688
Fixed
2521f494432e27415a567d3a81a9eb907abf20b3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.1.133.Final"
        },
        {
            "fixed": "4.1.138.Final"
        },
        {
            "introduced": "4.2.13.Final"
        },
        {
            "fixed": "4.2.18.Final"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

netty-4.*
netty-4.1.133.Final
netty-4.1.134.Final
netty-4.1.135.Final
netty-4.1.136.Final
netty-4.1.137.Final
netty-4.2.13.Final
netty-4.2.14.Final
netty-4.2.15.Final
netty-4.2.16.Final
netty-4.2.17.Final
Other
netty-clang-bin

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89044.json"