CVE-2026-93562Medium· 6.5▾ TwilightPoC availableA flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
0.3% → 0.6%
Last analysed / modified upstream
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93566Medium· 6.5A flaw was found in Netty
CVE-2026-93558High· 7.5A flaw was found in Netty's WebSocketServerExtensionHandler
CVE-2026-93574Medium· 6.5A flaw was found in Netty's `netty-codec-http` component
CVE-2026-93579Medium· 6.5A flaw was found in Netty's HTTP/2 stack
CVE-2026-93573Medium· 6.5A flaw was found in Netty's HTTP/1.1 decoder
CVE-2026-93564High· 7.5A flaw was found in Netty