CVE-2026-93566

Executive Summary

CVE-2026-93566 is an HTTP request smuggling vulnerability in Netty's HttpObjectDecoder, caused by insufficient validation of chunk size lines that lack a chunk extension. When a chunk size line contains an embedded bare carriage return (CR) without a ; character, the strict validator HttpChunkLineValidatingByteProcessor is never executed, allowing a malformed line to be accepted rather than rejected.

Organizations running Netty-based HTTP servers, proxies, or API gateways — particularly those deployed behind or in front of other HTTP intermediaries — are affected. Successful exploitation enables request smuggling, which can lead to cache poisoning, authentication bypass, access control circumvention, and credential/request confusion between front-end and back-end systems. There is currently no patch, no public PoC, and no CISA KEV listing; the CVE is scored 6.5 (Medium) and is not yet scored by FIRST.org for EPSS.

Technical Analysis

Vulnerability Class

The flaw is a HTTP request smuggling (desync) issue rooted in an incomplete RFC 9112 conformance check. RFC 9112 Appendix A defines the chunk size line grammar strictly:

chunk-size = 1*HEXDIG

Any character outside the HEXDIG class — including a bare CR that is not part of the terminating CRLF — is illegal. Netty's decoder fails to enforce this constraint when no chunk extension is present.

Code-Level Mechanism

Per the NVD description, io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions implements the validation gate as follows:

int extensionsStart = line.bytesBefore((byte) ';');
if (extensionsStart == -1) {
    return;
}

The method returns early — skipping the strict validator HttpChunkLineValidatingByteProcessor — whenever a ; is absent from the chunk size line. This means:

• Chunk line WITH extension (; present): strict validation runs; malformed CR is rejected.
• Chunk line WITHOUT extension (; absent): validation is skipped entirely; a line such as 0\rX is accepted as a valid chunk size terminator.

The consequence is that the decoder's interpretation of the end of the chunked body can diverge from that of an upstream intermediary (proxy, load balancer, CDN, WAF) that correctly applies the grammar and rejects or re-frames the malformed line. Divergent parsing between two HTTP endpoints is the canonical precondition for request smuggling.

Attack Surface

Any deployment where Netty's HTTP codec terminates a Transfer-Encoding: chunked request stream and that stream has previously passed through or will subsequently be forwarded to a second HTTP parser. Typical topologies include:

• Reverse proxies / CDNs fronting a Netty-based origin
• Netty-based API gateways forwarding to Java servlet backends
• Load balancers performing HTTP framing decisions upstream of a Netty service

The vulnerability is network-reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and the attack complexity is assessed as Low (AC:L) because the malformed line is deterministic and the primitive is well understood.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE. The chain below is inferred at the vulnerability-class level from the NVD description. Only class, method, and processor names present verbatim in the description are used.

1) Reconnaissance / target identification. An attacker identifies a target whose request path traverses at least two HTTP parsers, where the downstream parser is a Netty-based service using HttpObjectDecoder for chunked request decoding. This is typically inferred by observing response headers, error behaviors, and the presence of an HTTP intermediary (CDN, reverse proxy, gateway) in front of a Netty origin.

2) Triggering the flaw class. The attacker submits an HTTP/1.1 request with Transfer-Encoding: chunked containing a chunk size line of the form 0\rX — that is, a valid chunk size of zero followed by an embedded bare CR and an additional character, with no semicolon in the line. Because checkChunkExtensions returns early when no ; is present, HttpChunkLineValidatingByteProcessor is not invoked, and Netty accepts the line instead of rejecting it.

3) Payload / execution method. The crafted body embeds a second HTTP request after the malformed chunk terminator so that one parser treats the trailing bytes as part of the first request body while the other parses them as a new, independent request. The NVD-supplied PoC demonstrates the structural shape: a POST / chunked request whose body contains 0\rX\r\n followed by GET /smuggled HTTP/1.1 with its own Host and Content-Length headers. The precise desync variant (CL.TE, TE.CL, or TE.TE) depends on the specific intermediary pairing.

4) Post-exploitation impact. Successful smuggling enables: cache poisoning (a smuggled response stored and served to other users), authentication/authorization bypass (a smuggled request reaches a protected route with the front-end's session context or bypassing front-end ACLs), and request/response queue poisoning that can capture or misroute other users' traffic. The CVSS subscores reflect confidentiality and integrity impact (C:L / I:L) with no availability impact (A:N).

Impact Assessment

Business impact. Request smuggling is a high-leverage primitive: while individual CVSS subscores are Low for C/I, the downstream consequences (session hijacking, cache poisoning at shared edges, WAF bypass) can affect all users behind the affected intermediary. Blast radius is bounded by how widely the Netty-based service is reachable and whether it sits behind a shared caching layer.

Affected systems. Netty-based HTTP servers, gateways, proxies, gRPC-over-HTTP/1.1 bridges, and any JVM service embedding HttpObjectDecoder / HttpRequestDecoder for inbound chunked framing. Exact affected version boundaries are not available from tracked sources; no OSV package ranges were provided.

Detection Guidance

Detections below target the structural characteristics of the exploit primitive (malformed chunk size line with embedded bare CR, no extension). They should be tuned and false-positive-tested in the target environment before production deployment.

Sigma Rule

title: Netty HTTP Request Smuggling via Malformed Chunk Size (CVE-2026-93566)
id: 7b2e9a1c-9356-6a1f-9c00-000093566cve
status: experimental
description: Detects HTTP requests containing a chunked body with a chunk size line that embeds a bare CR without a chunk extension, matching CVE-2026-93566.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93566
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_te:
    cs-header|contains: 'chunked'
  selection_body:
    cs-uri-query|contains: '\r'
  condition: selection_method and selection_te and selection_body
fields:
  - c-ip
  - cs-method
  - cs-uri
  - cs-header
falsepositives:
  - Legitimate encoded CR in URI query strings
level: medium

YARA Rule

rule CVE_2026_93566_Netty_ChunkSmuggle
{
    meta:
        author      = "valtersit.com"
        description = "Detects raw HTTP payloads with a malformed chunk size line containing an embedded bare CR and no chunk extension (CVE-2026-93566)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-93566"
        date        = "2026-01-01"
        severity    = "medium"

    strings:
        $te    = "Transfer-Encoding: chunked" nocase ascii
        $bad1  = /0\x0D[^\x0A\\r\\n]/ ascii   // '0' + bare CR + non-LF
        $bad2  = /[0-9A-Fa-f]{1,8}\x0D[^\x0A]/ ascii

    condition:
        uint16(0) == 0x4F50 or $te or any of ($bad*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-93566 Netty HTTP Request Smuggling - Malformed Chunk Size Line"; flow:established,to_server; content:"Transfer-Encoding: chunked"; http_header; nocase; content:"|0D|"; http_header; pcre:"/(^|\\r\\n)0\\r[^\\n]/R"; reference:cve,2026-93566; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93566; classtype:attempted-admin; sid:202693566; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http"
      and http.request.method in ("POST","PUT","PATCH")
      and http.request.headers contains "Transfer-Encoding: chunked" ]
  [ network where network.protocol == "http"
      and http.request.body.text contains "\r" ]

Splunk SPL Query

index=* sourcetype=access_combined OR sourcetype=stream:http
| eval raw = coalesce(uri_query, http_user_agent, cs_uri_query, _raw)
| where match(raw, "(?i)transfer-encoding:\s*chunked")
| rex field=_raw max_match=0 "(?<chunkline>\r?\n[0-9A-Fa-f]{1,8}\r[^\n])"
| where isnotnull(chunkline)
| stats count values(chunkline) as suspicious_lines by src_ip, dest_ip, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve-2026-93566,">
  <rule id="935660" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.headers">Transfer-Encoding: chunked</field>
    <regex type="pcre2">(?i)transfer-encoding:\s*chunked</regex>
    <description>CVE-2026-93566: chunked request with potential malformed chunk size line (Netty smuggling)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93566,request_smuggling,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source. No vendor fix, workaround, or affected version range is currently available.

1) Immediate mitigations

• Normalize or reject chunked request framing at the network edge: ensure upstream proxies/CDNs strictly enforce RFC 9112 chunk grammar and strip or reject any chunk size line containing characters outside 1*HEXDIG (plus optional extension).
• Where feasible, disable Transfer-Encoding: chunked for untrusted inbound traffic, or require strict normalization to a re-encoded body before forwarding to Netty-based origins.
• Deploy the detection rules above in the interim to observe attempted exploitation and desync patterns.
• Avoid heterogeneous parser topologies (a Netty origin behind an intermediary with different chunk parsing rules) until patched.

2) Patch / upgrade steps

• No official fix is currently available. Monitor the Netty project's security advisories and release notes for a version that extends HttpObjectDecoder#checkChunkExtensions to run the strict validator regardless of whether a ; (extension) is present.
• Track the NVD entry for CVE-2026-93566 and any CNA/vendor advisory for the corrected release identifier before upgrading.

3) Long-term hardening

• Enforce a single, consistent HTTP framing/parsing implementation across the request path, or run an HTTP request-smuggling-aware normalizer at the edge.
• Adopt strict RFC 9112 Appendix A grammar validation in all JVM HTTP decoders.
• Add regression tests that exercise chunk size lines with embedded bare CR, lone LF, embedded NUL, and mixed line terminators.
• Continuously fuzz chunked-body parsing between every intermediary pair in the request path.

References

1. NVD — CVE-2026-93566: https://nvd.nist.gov/vuln/detail/CVE-2026-93566
2. RFC 9112 — HTTP/1.1, Appendix A (chunk-size = 1*HEXDIG): https://datatracker.ietf.org/doc/html/rfc9112#appendix-A
3. Netty project security advisories / release notes: https://netty.io/news/
4. CWE-1035 — OWASP Top Ten 2017 Category A9 / related weakness lineage: https://cwe.mitre.org/data/definitions/1035.html
5. FIRST EPSS (not yet scored as of writing): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing were identified. No known threat actor campaigns are associated with CVE-2026-93566 at the time of writing. Exploitation is assessed as not observed in the wild, though the underlying request-smuggling class remains a well-understood and frequently targeted technique.