Netty, a Java-based network framework, misparses quoted strings in the chunked transfer encoding extension of HTTP/1.1 requests. This parsing flaw permits an attacker to inject specially crafted chunk extensions that are incorrectly interpreted by Netty, resulting in HTTP request smuggling. The smuggled request can bypass normal processing pipelines, potentially enabling the attacker to inject requests, bypass authentication checks, or cause denial‑of‑service conditions. The vulnerability is categorized as CWE‑444 because it involves untrusted input being parsed incorrectly.

The issue affects all deployments of Netty 4.1 prior to version 4.1.132.Final and Netty 4.2 prior to 4.2.10.Final. Applications using these older versions of the Netty framework are susceptible to the smuggling attack. Updating to at least 4.1.132.Final or 4.2.10.Final removes the vulnerability.

The vulnerability carries a CVSS score of 7.5, indicating high severity. While an EPSS score is not available, the lack of public exploitation and its absence from the KEV catalog suggest that it has not yet been widely used in the wild, but the potential impact remains significant. The attack vector is inferred to be a network-based HTTP request that an attacker can send to any service that parses HTTP traffic with the affected Netty version. The attacker would craft a request that uses the chunked transfer encoding with quoted‑string extensions, leading Netty to misparse the request and allow request smuggling.