CVE-2026-93574

Executive Summary

CVE-2026-93574 is a request-smuggling vulnerability (CWE-444) in Netty's netty-codec-http component caused by incorrect parsing of HTTP/1.1 chunk-size tokens that contain post-digit whitespace. A remote, unauthenticated attacker can send a specially crafted chunked-transfer request that is interpreted differently by Netty-based proxies and their upstream backend, enabling HTTP request smuggling. Successful exploitation allows the attacker to bypass security controls or access unauthorized resources in proxy/backend deployments, producing a partial integrity and availability impact (CVSS 6.5, medium severity). The vulnerability currently has no public PoC, no exploit code, no Nuclei template, and no patch evidence from any tracked source; affected version ranges remain undefined in the available intelligence.

Technical Analysis

The vulnerability resides in the HTTP/1.1 chunked transfer-encoding parser implemented within Netty's netty-codec-http component. HTTP/1.1 chunked encoding is defined so that the size of each chunk is expressed as a hexadecimal number terminated by a CRLF. The parsing of the chunk-size token is a classic source of HTTP request smuggling (CWE-444) because intermediaries (reverse proxies, load balancers, CDNs) and origin servers frequently disagree on exactly where a chunk header ends and where whitespace is permitted.

Per the NVD description, the specific defect is the handling of "post-digit whitespace" in the chunk-size token — that is, whitespace appearing after the hexadecimal digits of a chunk size but within the chunk-size line. When a parser accepts or mis-frames trailing whitespace that another parser rejects (or vice versa), the two peers compute different message boundaries. An attacker who knows both behaviors can craft a single HTTP/1.1 stream that is parsed as one request by the front-end proxy but as a different, attacker-supplied request by the backend. This is the canonical request-smuggling primitive described in the CWE-444 classification.

Request smuggling via chunked-encoding disagreements generally manifests in two forms relevant here:

1. CL.TE / TE.CL desynchronization — the front-end and back-end use conflicting rules for Content-Length versus Transfer-Encoding, or compute different chunk lengths, so bytes the front-end considers the "body" are interpreted by the back-end as the start of a new request (or vice versa).
2. TE.TE obfuscation — both endpoints support Transfer-Encoding: chunked, but one ignores an obfuscated or malformed variant, again producing a parser disagreement.

The "post-digit whitespace" parsing error is an instance of the second family: the chunk-size token is ambiguous, and Netty's codec resolves the ambiguity differently from a peer parser. The result is that the chunk framing on one side does not match the other, leaving a smuggled request embedded in the stream.

The attack surface is any deployment where a Netty-based HTTP server, proxy, or gateway sits in front of, behind, or beside another HTTP parser that does not share Netty's whitespace-tolerance behavior. Because the flaw is in a codec (a protocol-level parser), it is reachable by any remote client that can send HTTP/1.1 traffic to a Netty endpoint — no authentication is required (PR:N), no user interaction is needed (UI:N), and the attack is network-reachable (AV:N). The only constraint is that the vulnerable Netty parser must be positioned such that another parser processes the same byte stream (the proxy/backend topology explicitly named in the description).

Insufficient technical detail is available regarding the exact function or class responsible, the specific whitespace characters accepted, and the precise affected Netty release versions. Those specifics are not present in the supplied NVD description or CNA title and are therefore not asserted here. What is confirmable is the vulnerability class (HTTP request smuggling), the component (netty-codec-http), the trigger vector (HTTP/1.1 chunk-size token with post-digit whitespace), and the consequence (proxy/backend desynchronization leading to control bypass or unauthorized access).

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-93574. The following attack chain is inferred strictly from the vulnerability class (CWE-444 request smuggling) and the mechanisms named in the NVD description. Specific function names, payload byte sequences, and internal identifiers are intentionally not fabricated.

1. Reconnaissance / target identification. The attacker identifies an environment where a Netty-based HTTP component (netty-codec-http) participates in request processing in front of a backend — for example, a Netty-based reverse proxy, API gateway, or application server chained to an upstream origin. Fingerprinting focuses on HTTP/1.1 responses that reveal Netty (e.g., default headers, error pages, or timing behavior) and on the presence of a proxy/backend topology where two distinct HTTP parsers handle the same request stream.

2. Triggering the flaw class. The attacker sends an HTTP/1.1 request using Transfer-Encoding: chunked in which the chunk-size token is malformed by including post-digit whitespace. This produces a parser disagreement: Netty parses the chunk boundary one way, while the peer (proxy or backend) parses it another way. The exact whitespace character and placement are not documented in the available intelligence.

3. Payload / execution method (vulnerability-class level). Because the two parsers disagree on where the current request ends, the attacker can append or embed a second HTTP request inside what one parser treats as body data. That smuggled request is then processed by the backend as if it originated from the trusted front-end. In CL.TE-style scenarios, a Content-Length-declared body can contain a smuggled chunked request; in TE-style scenarios, the smuggled request is embedded after a crafted chunk terminator. The attacker does not need valid credentials to inject the smuggled request.

4. Post-exploitation impact. The smuggled request can be used to bypass front-end security controls (e.g., authentication, authorization, rate limiting, or WAF inspection) because those controls act on the front-end's interpretation of the stream, not the backend's. Consequences include accessing resources that should be restricted to other users, poisoning the backend connection pool so that subsequent legitimate users receive attacker-controlled responses, and — where the smuggled request reaches privileged endpoints — performing actions with the backend's implicit trust of the proxy. The CVSS vector reflects a partial integrity impact (I:L) and partial availability impact (A:L), with no confidentiality impact scored (C:N), consistent with request-smuggling effects that manipulate request/response routing rather than directly exfiltrating data.

Impact Assessment

Severity: CVSS 3.1 base score 6.5 (Medium). Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

• Attack Vector (Network): Exploitable remotely across the network; no local access required.
• Attack Complexity (Low): Once the parser disagreement is understood, the crafted chunk-size token can be sent directly; no special conditions or race windows are scored.
• Privileges Required (None): The attacker needs no credentials to inject the malformed chunked request.
• User Interaction (None): No victim must click or interact; the desynchronization is server-side.
• Scope (Unchanged): Impact remains within the authorization scope of the vulnerable component.
• Confidentiality (None): The scored impact does not include direct data disclosure.
• Integrity (Low): The attacker can cause the backend to process smuggled requests, altering the effective request stream and potentially bypassing controls.
• Availability (Low): Connection-pool poisoning and desynchronized state can degrade or interrupt service for legitimate users.

Blast radius. Any deployment that places netty-codec-http in a multi-parser HTTP path is exposed. This includes Netty-based gateways, proxies, service meshes, and application servers fronted by or fronting another HTTP implementation. Because request smuggling is a stream-level desynchronization, a single attacker connection can poison a shared backend connection pool, meaning one attacker can affect many subsequent legitimate users — amplifying the effective blast radius well beyond a single session.

Business impact. Front-end security controls (WAF, authentication gateways, authorization layers) can be bypassed; unauthorized resources may become reachable; and shared-connection poisoning can cause cross-user request/response mixups. For organizations relying on Netty for internet-facing ingress, this represents a meaningful exposure that should be prioritized even at medium severity, particularly given the absence of a patch.

Detection Guidance

Detection for request smuggling is inherently probabilistic: benign chunked-encoding traffic is common, so rules must target anomalies (whitespace in chunk-size tokens, framing inconsistencies, repeated smuggling indicators) and correlate them with backend behavior. The rules below are detection scaffolding for the vulnerability class and component; thresholds should be tuned to each environment.

Sigma Rule

title: Potential Netty netty-codec-http HTTP Request Smuggling via Malformed Chunk-Size Token
id: 9c1f2a74-9357-4c2b-9d3e-000093574a01
status: experimental
description: Detects HTTP/1.1 chunked requests containing whitespace within the chunk-size token (post-digit whitespace), consistent with CVE-2026-93574 request smuggling in Netty netty-codec-http.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93574
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_te:
    cs-uri-query|contains: 'chunk'
  selection_chunked:
    cs-headers|contains: 'Transfer-Encoding: chunked'
  selection_whitespace:
    cs-body|re: '(?m)^[0-9a-fA-F]+\s+\r?$'
  condition: selection_method and selection_chunked and selection_whitespace
falsepositives:
  - Legitimate clients that do not follow strict chunk-size formatting
  - Proxies that normalize whitespace before logging
level: medium
tags:
  - attack.t1190
  - cwe.444

YARA Rule

rule CVE_2026_93574_Netty_Chunked_Smuggling
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP/1.1 chunked payloads with post-digit whitespace in the chunk-size token, indicating CVE-2026-93574 request smuggling attempts against Netty netty-codec-http"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93574"
        date = "2026-01-01"
        severity = "medium"
        cve = "CVE-2026-93574"

    strings:
        $te = "Transfer-Encoding: chunked" nocase
        $te2 = "Transfer-Encoding:chunked" nocase
        $chunk_ws_1 = /\r\n[0-9a-fA-F]{1,8}[ \t]+\r\n/
        $chunk_ws_2 = /\r\n[0-9a-fA-F]{1,8}[ \t]+;/

    condition:
        ($te or $te2) and any of ($chunk_ws_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93574 Netty netty-codec-http HTTP Request Smuggling via Malformed Chunk-Size Token"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Transfer-Encoding"; nocase; http.header; content:"chunked"; nocase; pcre:"/\r\n[0-9a-fA-F]{1,8}[ \t]+\r\n/"; classtype:web-application-attack; reference:cve,2026-93574; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93574; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium; sid:90093574; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method in ("POST", "PUT", "PATCH") and
      http.request.headers contains "Transfer-Encoding" and
      http.request.headers contains "chunked" ]
  [ network where http.request.body.text matches~ "\\r\\n[0-9a-fA-F]{1,8}[ \\t]+\\r\\n" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=netty
| eval body=coalesce(http_body, request_body, form_data)
| where match(body, "(?m)^[0-9a-fA-F]{1,8}[ \t]+\r?$")
| rex field=body "(?<chunk_line>[0-9a-fA-F]{1,8}[ \t]+)"
| where match(_raw, "(?i)Transfer-Encoding.*chunked")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as clients values(uri) as uris by host, chunk_line
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,netty,attack,">
  <rule id="935740" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST|PUT|PATCH</field>
    <regex type="pcre2">Transfer-Encoding:\s*chunked</regex>
    <description>CVE-2026-93574: Netty chunked request with malformed chunk-size token - possible HTTP request smuggling attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_444,request_smuggling,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source: no vendor fix, no upstream commit reference, no affected-version range, and no official workaround are available. The guidance below focuses on defense-in-depth controls that reduce exploitability of request smuggling (CWE-444) regardless of patch status.

1) Immediate mitigations

• Enforce strict chunk-size parsing at the perimeter. Configure front-end proxies, load balancers, and WAFs to reject or normalize HTTP/1.1 chunked requests whose chunk-size tokens contain any trailing whitespace. Many reverse proxies can be configured to strip or reject such lines before forwarding.
• Normalize the request stream at a single parser. Terminate HTTP at the front-end, re-encode the request with strict framing, and forward using a consistent, unambiguous encoding (e.g., HTTP/2 or a canonicalized HTTP/1.1 stream). This removes the parser-disagreement precondition entirely.
• Disable chunked transfer-encoding where not required. If the application does not need chunked uploads, reject Transfer-Encoding: chunked outright at the edge.
• Use HTTP/2 end-to-end. HTTP/2 framing is not vulnerable to HTTP/1.1 chunk-size parsing ambiguity; deploy it for inbound and, where feasible, for proxy-to-backend connections.
• Segment proxy and backend deployments. Ensure security controls (auth, WAF) are applied at the backend, not only the front-end, so a smuggled request cannot bypass them.

2) Patch / upgrade steps

• Monitor Netty's official release channels and the netty-codec-http module for a fixed release. Because affected-version ranges are currently undefined, inventory all Netty-based components and their netty-codec-http versions, and prepare an upgrade path.
• Track the CVE record at NVD for the authoritative CNA/vendor fix reference, and subscribe to Netty project security advisories.
• When a fixed version is published, prioritize internet-facing Netty ingress points and any Netty component chained to a backend parser.

3) Long-term hardening

• Maintain an authoritative software bill of materials (SBOM) covering Netty and all HTTP-parsing dependencies so exposure can be assessed quickly when ranges are published.
• Adopt a "single canonical parser" architecture principle for all HTTP ingress to eliminate parser-differential classes such as CWE-444 at the design level.
• Continuously fuzz and regression-test chunked-encoding handling for whitespace and boundary obfuscation cases as part of CI for any HTTP-handling component.
• Tune and deploy the detection rules above, and validate detections with safe internal test harnesses (no live exploitation).

References

1. NVD — CVE-2026-93574: https://nvd.nist.gov/vuln/detail/CVE-2026-93574
2. CWE-444 — Inconsistent Interpretation of HTTP Requests ("HTTP Request Smuggling"): https://cwe.mitre.org/data/definitions/444.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Netty Project — official project and security advisories: https://netty.io/
5. FIRST EPSS — CVE score lookup (not yet scored for this CVE at time of writing): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status. No exploit code, no public PoC, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-93574 in the provided intelligence. There is no evidence of known threat actor campaigns or in-the-wild exploitation at this time. All exploitation analysis above is derived from the vulnerability class and the vendor-supplied description, not from observed attacks.