CVE-2026-50020: CVE-2026-50020: HTTP Request Smuggling in Netty HttpObjectDecoder via Arbitrary Leading Control Bytes

#security #cve #cybersecurity

CVE-2026-50020: HTTP Request Smuggling in Netty HttpObjectDecoder via Arbitrary Leading Control Bytes

Vulnerability ID: CVE-2026-50020
CVSS Score: 5.3
Published: 2026-06-15

CVE-2026-50020 is a medium-severity HTTP Request Smuggling/Response Smuggling vulnerability (CWE-444) within the Netty asynchronous network application framework. The flaw resides in Netty's HTTP codec implementation, specifically the HttpObjectDecoder class, which silently consumes arbitrary ISO control bytes preceding the first request line.

TL;DR

Netty's HTTP decoder silently skips leading non-CRLF control characters (like SOH or NUL), allowing attackers to smuggle HTTP requests through reverse proxies.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-444
Attack Vector: Network
CVSS v3.1 Score: 5.3 (Medium)
EPSS Score: 0.00232 (0.23%)
EPSS Percentile: 13.85%
Exploit Status: Proof of Concept (PoC)
CISA KEV Status: Not Listed

Affected Systems

io.netty:netty-codec-http
netty-codec-http: >= 4.1.0, < 4.1.135.Final (Fixed in: 4.1.135.Final)
netty-codec-http: >= 4.2.0, < 4.2.15.Final (Fixed in: 4.2.15.Final)

Mitigation Strategies

Upgrade Netty to version 4.1.135.Final, 4.2.15.Final, or later.
Disable HTTP pipelining and connection keep-alive on backends to prevent socket reuse.
Enable HTTP/2 on backend connections to isolate distinct requests structurally.

Remediation Steps:

Review all Maven and Gradle dependency hierarchies for transitive Netty dependencies.
Apply dependency management overrides in build files to force io.netty:netty-codec-http to 4.1.135.Final or 4.2.15.Final.
Configure reverse proxies (e.g. NGINX, HAProxy) to block non-printable control characters in incoming HTTP bodies.

References

Read the full report for CVE-2026-50020 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community