CVE-2026-93573

Executive Summary

CVE-2026-93573 is an HTTP request-smuggling vulnerability in the Netty networking framework caused by improper handling of multiple (split) Transfer-Encoding headers, which allows an attacker to bypass the final-chunked validation performed by Netty's HTTP/1.1 decoder. The flaw is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / Request Smuggling). Any application, API gateway, reverse proxy, or service built on the affected Netty HTTP codec that sits behind a front-end proxy with different header-parsing semantics is potentially affected. Successful exploitation enables request smuggling, allowing an attacker to poison shared connections, bypass access controls, and inject unauthorized requests with limited but meaningful integrity and confidentiality impact (CVSS 6.5, C:L/I:L/A:N). No public proof-of-concept, exploit code, or Nuclei template currently exists, and no patch has been identified.

Technical Analysis

The vulnerability resides in the HTTP/1.1 message-parsing logic of Netty, a widely deployed asynchronous network application framework used to build HTTP servers, clients, proxies, and protocol gateways. The core defect is a discrepancy in how Netty handles split Transfer-Encoding fields — that is, an HTTP request containing more than one Transfer-Encoding header line rather than a single combined header.

Per RFC 7230/9112, a message with multiple Transfer-Encoding header fields is only valid if the combined list resolves to a single chunked coding as the final encoding. When a message declares Transfer-Encoding: chunked, the recipient must parse the body length using chunked framing. Request smuggling (CWE-444) arises when two HTTP intermediaries on the same connection disagree about where one request ends and the next begins. That disagreement is exactly what this bug enables: Netty's decoder does not correctly validate the final chunked coding when the Transfer-Encoding header is split across multiple fields, so it can reach a different framing conclusion than a front-end proxy parsing the same bytes.

The attack surface is any Netty-based HTTP/1.1 endpoint that processes chunked encodings and is positioned behind (or in front of) another HTTP parser — a classic proxy-chain topology (load balancer, CDN, API gateway, WAF, or reverse proxy). Because the vulnerability requires only network access (AV:N), low privileges (PR:N), and no user interaction (UI:N), it fits the opportunistic remote exploitation profile.

The description does not disclose specific class names, method names, header-processing function names, or file paths, so no implementation-level identifiers can be asserted here. What can be stated from the description alone: the flaw is specifically about multiple/split Transfer-Encoding fields and the bypass of "final-chunked validation." This is a parser-disagreement defect, not a memory-safety or cryptographic issue.

The CVSS assessment is consistent with a smuggling primitive that a single attacker controls only partially: confidentiality and integrity are Low (C:L/I:L) because smuggling can expose or alter one queued request in some topologies, and availability is Not impacted (A:N) because the flaw does not inherently crash the service.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description and CWE-444 mechanics. Follow the four phases:

1) Reconnaissance / target identification. An attacker identifies a target whose request path traverses two HTTP parsers in sequence — most commonly an edge proxy/CDN/load balancer forwarding to a Netty-based back-end, or a Netty-based reverse proxy forwarding to an application server. Fingerprinting focuses on the presence of chunked transfer-encoding support, HTTP/1.1 (not HTTP/2-only) endpoints, and any indication that Netty is used (response headers, timing, or known framework signatures). Because the bug concerns Transfer-Encoding parsing, an attacker probes how the front end reacts to unusual or duplicated transfer-encoding headers versus "normal" requests.

2) Trigger mechanism (vulnerability class). The attacker crafts an HTTP/1.1 request that includes split Transfer-Encoding fields — i.e., the Transfer-Encoding header is presented more than once (or otherwise split) such that Netty's decoder fails to enforce its final-chunked validation. The front-end parser and Netty evaluate the body boundary differently. Per the description, this is precisely the bypass: "split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling." No specific header ordering, delimiter, or byte sequence is provided in the source data, and none should be assumed.

3) Payload/execution (class level). Smuggling works by desynchronizing the connection: the attacker embeds a second, hidden request within the body of the first, positioned so that the front end treats it as body data while Netty treats it as the start of a new request (or vice versa). This "smuggled" request is then processed with the connection's trust context — potentially bypassing front-end authentication, authorization, or rate-limiting controls, or causing one user's request to be prefixed by another's injected content (request-queue poisoning). Because this is HTTP-level smuggling rather than code execution, the "payload" is a crafted HTTP request, not code.

4) Post-exploitation impact. Consequences are bounded per the CVSS vector: Low confidentiality and Low integrity. In practice that means potential access-control bypass to reach a limited set of back-end resources, injection of unauthorized requests into a victim's session queue, cache poisoning of a shared front end, or leaking fragments of a neighboring user's request — all dependent on the specific proxy/back-end topology. Availability is not directly affected.

Caveat: Because the NVD entry provides no function names, endpoints, or config details, no specific Netty classes, header constants, or file paths are stated. Any operational testing should replicate the parser-disagreement behavior against a controlled proxy→Netty chain, not against production systems.

Impact Assessment

Scope of impact. The impact is concentrated in multi-tier HTTP architectures where at least two independent parsers read the same request stream. A single-hop Netty server with no upstream proxy has reduced exposure because there is no parser to disagree with. Real-world blast radius therefore depends on deployment topology — shared, reused, or pooled upstream connections (front ends that keep-alive back-end connections across many users) maximize the risk.

CVSS subscore interpretation (6.5 Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N):

• AV:N — exploitable over the network; no local access required.
• AC:L — no special conditions beyond a susceptible parser chain.
• PR:N / UI:N — no credentials and no victim interaction needed.
• S:U — impact remains within the same security authority.
• C:L — smuggling can expose a limited amount of otherwise-inaccessible response data across a shared connection.
• I:L — an attacker can cause limited, unauthorized modification of request/response content (e.g., injecting a smuggled request).
• A:N — no measurable availability impact.

Business risk. For organizations running Netty-based API gateways, service meshes, or proxied microservices, the primary risks are authorization bypass at the edge, request-queue poisoning affecting other tenants/users on shared back-end connections, and cache poisoning. These are integrity/confidentiality failures that can undermine zero-trust edge controls without alerting on traditional indicators. The Medium score reflects partial attacker control over a shared connection, but in high-value, multi-tenant environments the practical business impact can be disproportionate.

Detection Guidance

Detection is challenging because smuggling payloads are valid-looking HTTP and often invisible to single-parser sensors. Best results come from normalizing and comparing how telemetry sources frame requests.

Sigma Rule

title: Potential HTTP Request Smuggling via Split Transfer-Encoding (CVE-2026-93573)
id: 8f6c1b42-9357-4a01-b7e2-9c0d3a5e6f10
status: experimental
description: Detects HTTP requests containing multiple or split Transfer-Encoding header fields, which may bypass final-chunked validation and enable request smuggling in Netty-based services.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93573
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-93573
logsource:
  category: webserver
  product: netty
detection:
  selection_smuggling_headers:
    cs-header|contains|all:
      - 'Transfer-Encoding'
    cs-header|re: '(?i)Transfer-Encoding:\s*chunked.*\r\n\s*Transfer-Encoding'
  selection_smuggling_combination:
    cs-header|re: '(?i)Transfer-Encoding:\s*chunked\s*,\s*chunked'
  condition: selection_smuggling_headers or selection_smuggling_combination
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-header
falsepositives:
  - Legitimate proxies that consolidate transfer-encoding headers
  - Non-standard clients generating duplicated headers
level: medium

Note: Sigma's web log schema varies by product; the regexes above target duplicated or comma-combined Transfer-Encoding: chunked presentations. Tune field mappings (cs-header, cs-uri-stem) to your parser.

YARA Rule

rule CVE_2026_93573_Netty_Split_Transfer_Encoding
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP payloads with split/multiple Transfer-Encoding fields indicative of request smuggling (CVE-2026-93573)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93573"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $te1 = "Transfer-Encoding: chunked" nocase ascii wide
        $te2 = "Transfer-Encoding:chunked" nocase ascii wide
        $te_split = "Transfer-Encoding: chunked, chunked" nocase ascii
        $te_multi = /Transfer-Encoding:\s*chunked[\r\n]+Transfer-Encoding:/nocase ascii
        $cl = "Content-Length:" nocase ascii

    condition:
        uint16(0) == 0x4854 or  // "HT" (HTTP)
        (any of ($te1, $te2, $te_split, $te_multi) and any of ($te_split, $te_multi))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93573 Possible Netty HTTP Request Smuggling via Split Transfer-Encoding"; flow:established,to_server; http.header; content:"Transfer-Encoding"; nocase; http.header; content:"chunked"; nocase; pcre:"/Transfer-Encoding:\s*chunked\s*[\r\n]+Transfer-Encoding:/Hi"; reference:cve,2026-93573; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93573; classtype:web-application-attack; sid:202693573; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where http.request.method in ("GET","POST","PUT","PATCH") and http.request.headers contains "Transfer-Encoding: chunked"]
  [network where http.request.headers contains "Transfer-Encoding" and http.request.headers regex "Transfer-Encoding:\\s*chunked[\\r\\n]+Transfer-Encoding:"]

EQL above is illustrative for network/HTTP event streams; adjust http.request.headers to the actual field your Elastic HTTP/proxy integration exposes, and consider the http.request.mime_type or raw request fields.

Splunk SPL Query

index=web OR index=proxy
| eval headers = coalesce(http_request_headers, cs_header, request_headers)
| where match(headers, "(?i)Transfer-Encoding:\\s*chunked[\\r\\n]+Transfer-Encoding:") OR match(headers, "(?i)Transfer-Encoding:\\s*chunked,\\s*chunked")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uris by src_ip, http_method
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve-2026-93573,">
  <rule id="20293573" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="request">Transfer-Encoding: chunked</field>
    <regex type="pcre2">(?i)Transfer-Encoding:\s*chunked\s*[\r\n]+Transfer-Encoding:</regex>
    <description>CVE-2026-93573: Possible Netty HTTP request smuggling via split Transfer-Encoding header from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,pci_dss_6.5,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; no vendor fix, workaround, OSV package mapping, or affected-version range has been provided. Netty has not published an advisory in the supplied data, and no CVE-linked upgrade path can be asserted. Treat any claim of a "fixed version" as unverified.

1) Immediate mitigations (defense in depth):

• Enforce HTTP parser consistency at the edge. Configure front-end proxies, CDNs, and load balancers to reject requests containing multiple Transfer-Encoding header fields, or to normalize Transfer-Encoding to a single, validated value before forwarding. RFC 7230 requires rejecting messages with conflicting or ambiguous framing.
• Reject ambiguous framing. Configure the edge to respond 400 Bad Request to any request mixing Content-Length and Transfer-Encoding, or containing duplicated/split Transfer-Encoding.
• Disable keep-alive / connection reuse where feasible between untrusted front ends and Netty back ends, reducing the connection-desynchronization window. This is a trade-off, not a fix.
• Prefer HTTP/2 end-to-end where possible, since the flaw is specific to HTTP/1.1 chunked framing.
• Contain exposure. Restrict direct network access to Netty-based services so only vetted proxies can reach them (network policy / segmentation), and tighten egress.

2) Patch / upgrade steps:

• Monitor the Netty project's security advisories and the official CVE-2026-93573 NVD entry for a patched release. (No version is disclosed; do not assume one.)
• When an advisory lands, stage the fix in a canary environment first, validating that the proxy→Netty chain no longer exhibits parser disagreement, then roll out to production.
• Track the Netty dependency in all applications (SBOM) to identify every affected service transitively using the framework.

3) Long-term hardening:

• Standardize on a single HTTP parser implementation across the request path, or explicitly align framing rules between all intermediaries.
• Add request-smuggling regression tests to CI/CD that simulate split/duplicated Transfer-Encoding and Content-Length/Transfer-Encoding conflicts.
• Maintain an SBOM and vulnerability-feed integration so framework CVEs like this surface immediately.
• Deploy deep-inspection sensors that reconstruct and compare framing across parser boundaries rather than trusting one parser's view.

References

1. NVD — CVE-2026-93573: https://nvd.nist.gov/vuln/detail/CVE-2026-93573
2. CWE-444 — Inconsistent Interpretation of HTTP Requests (Request Smuggling): https://cwe.mitre.org/data/definitions/444.html
3. RFC 7230 §3.3.3 — Transfer-Encoding and message body length (normative framing rules): https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
4. RFC 9112 §6.1 — Transfer-Encoding (updated HTTP/1.1 framing): https://datatracker.ietf.org/doc/html/rfc9112#section-6.1
5. Netty project security advisories (monitor for CVE-2026-93573 fix): https://netty.io/news/ and the Netty GitHub security advisories page.

Threat actor / exploit-in-the-wild status: No public PoC, exploit code, Nuclei template, or CISA KEV entry is associated with CVE-2026-93573 at the time of writing. No threat-actor campaign has been attributed. Exploitation is currently hypothetical and inferred from the CWE-444 vulnerability class.