CVE-2026-93562

Executive Summary

CVE-2026-93562 is an HTTP request smuggling vulnerability in Netty's HTTP/1 decoder, caused by incomplete validation of malformed Transfer-Encoding headers. A remote, unauthenticated attacker can send crafted HTTP requests to a Netty-based front-end or proxy layer and inject arbitrary HTTP requests into the connection stream, potentially bypassing access controls, cache keys, and authentication enforcement. All deployments that terminate or forward HTTP/1.x traffic through an affected Netty build are exposed; the CVSS score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a roughly-even split between confidentiality and integrity impact with no availability impact. As of this report, there is no public proof-of-concept, no Nuclei template, no CISA KEV listing, and — critically — no patch evidence from any tracked source, leaving defenders dependent on architectural and network-layer mitigations.

Technical Analysis

HTTP request smuggling is a class of desynchronization attack that exploits discrepancies between how two HTTP parsers (typically a front-end proxy/load balancer and a back-end origin server) interpret the boundaries of a request. The canonical delivery mechanism is a malformed or ambiguous Transfer-Encoding header — most famously the Transfer-Encoding: chunked versus Content-Length conflict, and obfuscated variants of the Transfer-Encoding field value.

CVE-2026-93562 is described by NVD as a flaw in Netty's HTTP/1 decoder in which validation of malformed Transfer-Encoding headers is incomplete. This means the decoder can accept a Transfer-Encoding header construct that a downstream or upstream peer will parse differently, producing two different notions of where one request ends and the next begins. When a Netty-based component is positioned as the front-end (for example, embedded in an API gateway, reverse proxy, or application server that forwards to a downstream origin), an attacker can craft a single request whose desynchronized framing causes the second, attacker-controlled request to be prepended to the next legitimate user's request.

The two classic exploit shapes apply to this vulnerability class regardless of the specific malformed header variant:

1. CL.TE — the front-end honors Content-Length, the back-end honors Transfer-Encoding. The smuggled bytes ride in the body of the first request and are interpreted as a new request by the back-end.
2. TE.CL — the inverse. The front-end honors Transfer-Encoding, the back-end honors Content-Length.

Obfuscated Transfer-Encoding values (for example, casing variations, whitespace padding, or duplicated/conflicting header lines) are the standard way an attacker forces one peer to reject and the other to accept the header. Because NVD states the flaw lies in incomplete validation, the practical implication is that at least one such obfuscation is not rejected by the Netty decoder. The exact malformed value that bypasses validation is not disclosed in the CVE record and is not reproduced here — inventing a specific header string would violate the accuracy constraints of this report.

Attack surface. Any network path where a Netty HTTP/1 decoder sits on one side of a connection and a differently-implemented HTTP parser (CDN edge, WAF, load balancer, second proxy, or origin server) sits on the other. Netty is widely embedded — it powers numerous Java-based HTTP servers, proxies, and frameworks — so the vulnerable component is frequently not the application the operator believes they deployed. This is a key triage difficulty: the CVE record does not name affected versions or downstream products.

Code-level note. NVD does not provide function names, class names, or file paths. No such details are fabricated here. The relevant decoder logic is, per the description, the HTTP/1 Transfer-Encoding header processing path; the defect is a validation gap (CWE-1035, Use of Insufficiently Trusted Header / header-handling weakness in the broader CWE taxonomy), not a memory-safety bug. There is no code-execution primitive — the impact is strictly request-boundary confusion.

Why severity is "Medium." CVSS 6.5 with S:U (unchanged scope), C:L and I:L, and A:N accurately models a vulnerability that compromises access-control decisions and data integrity (you can read or act on the victim's request/response context) without directly granting code execution or taking down the service. Availability impact is absent because smuggling does not inherently crash the target.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code exists for CVE-2026-93562 as of this report. The attack chain below is described at the vulnerability-class level and is consistent with the NVD description; it does not name implementation specifics that are not published.

1) Reconnaissance and target identification. The attacker first identifies an environment where a Netty-based HTTP/1 component sits behind or in front of a second HTTP parser. Fingerprinting focuses on response headers, server banners, error pages, and timing behavior that reveal the proxy/server pair (for example, an HTTP/1.1 front-end that normalizes headers differently than the origin). Because the CVE record does not disclose affected versions, the attacker cannot rely on version banners alone and will typically test parser behavior directly on candidate endpoints (API gateways, reverse proxies, and any host forwarding HTTP/1.1).

2) Triggering the flaw class. The attacker sends a request that contains a Transfer-Encoding header crafted to be interpreted differently by the two parsers. Per NVD, the flaw is incomplete validation of malformed Transfer-Encoding headers — so the attacker's goal is to submit a header value that the Netty HTTP/1 decoder does not reject but that a peer parses inconsistently. This is the desynchronization step: the front-end and back-end now disagree on message boundaries.

3) Payload/execution method (vulnerability-class level). Once desynchronized, the attacker appends a second HTTP request into the same connection. The smuggled request is a complete, well-formed HTTP request from the perspective of the back-end parser, even though the front-end attributed those bytes to the body of the first request. There is no memory corruption and no shell payload — the "execution" here is the back-end honoring an attacker-supplied request that the front-end never intended to forward. This is the request-smuggling primitive described in NVD: "inject arbitrary HTTP requests."

4) Post-exploitation impact. The typical consequences, again drawn from the CVE description and the general class, are:

• Security-control bypass — the smuggled request is not seen or filtered by the front-end (WAF/access-control layer), since the front-end believes those bytes are a request body.
• Unauthorized resource access — the smuggled request can target internal or restricted endpoints reachable from the back-end.
• Request hijacking / cache poisoning — if another user's request follows on the same connection, the smuggled prefix can be executed in that user's context, enabling session or authorization confusion and cache poisoning of shared caches.
• Credential/session theft at the class level — by capturing the response to a victim's request, an attacker may obtain data the victim was authorized to see.

Because no in-the-wild exploitation is confirmed and no PoC is public, defenders should treat this as a latent, high-value primitive: it is attractive to attackers precisely because it is stealthy and bypasses front-end filtering, but it is not currently observed in the wild per available data.

Impact Assessment

• CVSS 6.5 – Medium. AV:N (network, no adjacency required), AC:L (no special conditions — a single crafted request suffices), PR:N (unauthenticated), UI:N (no victim interaction). These four factors mean the barrier to attempting exploitation is essentially zero once a vulnerable topology is found.
• Confidentiality: Low (C:L). The attacker can access data or responses tied to smuggled requests, but not necessarily the entire data store.
• Integrity: Low (I:L). Smuggled requests can alter server-side state or poison caches, but the primitive is not a general write primitive.
• Availability: None (A:N). The vulnerability does not degrade or deny service by itself.
• Scope: Unchanged (S:U). Impact is confined to the vulnerable component's security authority — though in practice the business blast radius can extend to every application behind the affected proxy.

Blast radius. Because Netty is embedded in many upstream products and frameworks rather than deployed as a single named appliance, the affected population is potentially large but currently unbounded — no affected-versions list or OSV package mapping exists. Organizations that terminate HTTP/1.1 at a Netty-based layer (API gateways, service meshes, custom proxies, Java application servers) should assume exposure until proven otherwise. The highest-risk deployments are those with (a) a front-end/back-end parser pair, (b) shared connection reuse or keep-alive, and (c) encrypted connections terminating in front of the Netty component while HTTP/1.1 is used internally. Business impact maps to broken access-control guarantees, potential data exposure across tenants, and cache-poisoning of shared edge caches.

Detection Guidance

Detection must target the behavioral signature of parser desynchronization, since the exact malformed Transfer-Encoding value is undisclosed. Rules below focus on anomalous Transfer-Encoding usage, conflicting Content-Length/Transfer-Encoding headers, and request-boundary anomalies.

Sigma Rule

title: Potential HTTP Request Smuggling via Malformed Transfer-Encoding (CVE-2026-93562)
id: 8f3c1a92-7b64-4e0d-9c11-2a6d5f0e9356
status: experimental
description: Detects HTTP requests with ambiguous or conflicting Transfer-Encoding and Content-Length headers consistent with request smuggling against a Netty HTTP/1 decoder.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93562
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_te:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_te_values:
    cs-uri-query|contains:
      - 'Transfer-Encoding'
  keywords_te:
    - 'Transfer-Encoding: chunked'
    - 'Transfer-Encoding:chunked'
    - 'Transfer-Encoding : chunked'
    - 'Transfer-Encoding: identity, chunked'
    - 'Transfer-Encoding: chunked, identity'
  keywords_cl_te:
    - 'Content-Length'
  condition: selection_te and (keywords_te or (keywords_cl_te and keywords_te))
  falsepositives:
    - Legitimate clients using non-standard but RFC-compliant Transfer-Encoding
    - Proxies that rewrite Transfer-Encoding headers
level: medium
tags:
  - attack.t1190
  - cve.2026.93562

(Note: field names in the logsource mapping should be adapted to the schema of the target web-server log source — e.g., Apache cs-* vs. Nginx cs-*. Header inspection typically requires the raw request line or a header-aware parser.)

YARA Rule

rule CVE_2026_93562_Netty_Request_Smuggling
{
    meta:
        description = "Detects HTTP request artifacts consistent with Transfer-Encoding based HTTP request smuggling (CVE-2026-93562)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93562"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $te1 = "Transfer-Encoding: chunked" nocase
        $te2 = "Transfer-Encoding:chunked" nocase
        $te3 = "Transfer-Encoding : " nocase
        $te4 = "Transfer-Encoding: identity, chunked" nocase
        $te5 = "Transfer-Encoding: chunked, identity" nocase
        $cl  = "Content-Length:" nocase
        $http = "HTTP/1.1" nocase

    condition:
        $http and ($te1 or $te2 or $te3 or $te4 or $te5) and $cl
}

(Deploy against raw PCAP/HTTP capture files or request-body captures. This is a network/artifact-level rule, not a binary rule.)

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93562 Netty HTTP Request Smuggling via Malformed Transfer-Encoding"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Transfer-Encoding"; nocase; http.header; content:"Content-Length"; nocase; pcre:"/Transfer-Encoding\s*:\s*[^ \r\n]*[ ,]chunked/i"; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; reference:cve,2026-93562; sid:90093562; rev:1;)

(This rule fires on requests carrying both Transfer-Encoding and Content-Length together with an obfuscated chunked token — the core smuggling precondition. Tuning is required to reduce noise from legitimate dual-header traffic.)

Elastic Detection

// Detection of HTTP request smuggling preconditions against a Netty HTTP/1 parser (CVE-2026-93562)
network where network.protocol == "http" and
  http.request.method in ("POST", "PUT", "PATCH") and
  http.request.headers contains "Transfer-Encoding" and
  http.request.headers contains "Content-Length"

(A stricter variant should additionally match obfuscated chunked tokens if the pipeline preserves raw header text — e.g., matches "Transfer-Encoding\\s*:\\s*[^\\r\\n]*chunked". Because standard header parsing may normalize whitespace, raw-request capture is preferred where available.)

Splunk SPL Query

index=web OR index=proxy sourcetype IN ("access_combined","nginx:plus:kv","stream:http")
| rex field=_raw "(?i)Transfer-Encoding\s*:\s*(?<te_val>[^\r\n,]+)"
| rex field=_raw "(?i)Content-Length\s*:\s*(?<cl_val>\d+)"
| where isnotnull(te_val) AND isnotnull(cl_val)
| stats count values(uri) as uris values(src_ip) as src_ips by host, te_val
| where count > 0
| eval CVE="CVE-2026-93562"
| table host, te_val, count, uris, src_ips, CVE

(Run against raw or header-preserving web logs. Multiple Transfer-Encoding values (e.g., identity, chunked) or unusual casing/whitespace in te_val indicate the smuggling precondition. Add | where match(te_val, "(?i)identity") OR match(te_val, "chunked, ") for a tighter filter.)

Wazuh OSSEC Rule

<group name="web,request_smuggling,cve_2026_93562,">
  <rule id="10093562" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">Transfer-Encoding</field>
    <description>CVE-2026-93562: Possible HTTP request smuggling via malformed Transfer-Encoding header (Netty HTTP/1 decoder)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93562,attack.t1190,</group>
  </rule>

  <rule id="10093563" level="12">
    <if_sid>10093562</if_sid>
    <field name="url">Content-Length</field>
    <description>CVE-2026-93562: Ambiguous Content-Length and Transfer-Encoding headers detected — high-confidence smuggling attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93562,attack.t1190,</group>
  </rule>
</group>

(Requires the web access-log decoder and a log format that preserves the request header line, or a custom decoder for raw HTTP. Adjust field names to match your deployment's log field mapping.)

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, advisory, fixed version, package mapping, or workaround is available from any tracked source. The following guidance is defensive and architectural.

1) Immediate mitigations (until a patch exists):

• Reject ambiguous framing at the edge. Configure front-end proxies, WAFs, and load balancers to reject any HTTP request that contains both Transfer-Encoding and Content-Length, or that contains multiple/obfuscated Transfer-Encoding values (for example, values containing commas, casing anomalies, or whitespace before the colon). Most mature proxies can enforce this normalization.
• Normalize and enforce strict RFC 7230 §3.3.3 behavior at every HTTP parser in the path, so all components agree on message framing. Eliminating parser disagreement removes the smuggling primitive even without a code fix.
• Disable HTTP/1.1 keep-alive / connection reuse between the front-end and back-end as a temporary stopgap. Without connection reuse, the smuggled request has no victim connection to hijack — this substantially reduces (though does not eliminate) crossover impact.
• Enforce HTTP/2 (or TLS-terminated HTTP/2) end-to-end where feasible; request smuggling via Transfer-Encoding is an HTTP/1.x framing issue, and HTTP/2 uses a different, length-prefixed framing model that does not carry Transfer-Encoding semantics.
• Limit back-end reachability. Ensure smuggled requests cannot reach internal admin or metadata endpoints by segmenting networks and applying authorization at the origin, not only at the edge.
• Monitor and rate-limit. Apply the detection rules above and alert on anomalous Transfer-Encoding patterns, especially from a single source with repeated POSTs.

2) Patch / upgrade steps:

• No fixed version is identified. Monitor the NVD record, the Netty project's security advisories, and downstream product advisories (application servers, gateways, and frameworks that embed Netty) for a fixed release. Do not assume a specific version is safe — no affected-versions range has been published.
• When a fixed Netty release is announced, inventory every component embedding Netty (including transitive dependencies) and upgrade. Given the absence of an OSV package mapping, dependency-graph scanning for io.netty artifacts is the recommended discovery method.
• Validate the fix by re-testing parser agreement across the front-end/back-end pair after upgrade.

3) Long-term hardening:

• Adopt a single-parser or parser-agreement architecture where possible — terminate HTTP once and forward via a consistent protocol, minimizing the number of independent HTTP parsers in the path.
• Standardize on HTTP/2 or HTTP/3 internally to eliminate the Transfer-Encoding ambiguity surface entirely.
• Maintain an SBOM covering embedded networking libraries so that future Netty (or equivalent) CVEs can be triaged by component rather than by product.
• Continuously fuzz and regression-test the front-end/back-end pair for framing disagreement as part of CI/CD, since smuggling defects recur across parsers.

References

1. NVD — CVE-2026-93562: https://nvd.nist.gov/vuln/detail/CVE-2026-93562 — official record; source of the CVSS 6.5 vector and description.
2. Netty Project Security Advisories: https://netty.io/ — monitor for the eventual fix; no advisory for this CVE was available at time of writing.
3. CWE-1035 (Use of Insufficiently Trusted Header / header-handling weakness): https://cwe.mitre.org/data/definitions/1035.html — CWE assigned in the CVE record.
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — mapping for this vector.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-93562 is not listed; no in-the-wild exploitation is confirmed.

Threat actor / exploit-in-the-wild status: No known threat-actor campaigns and no confirmed exploitation in the wild. No public PoC, no Nuclei template, no Metasploit module, and no exploit code were identified. EPSS has not yet scored this CVE; no EPSS value is asserted. The absence of an assigned EPSS score and of any public exploit means defenders should prioritize the architectural mitigations above — the vulnerability class (HTTP request smuggling) is heavily exploited in the wild generally, even though this specific CVE is not yet observed to be.