The flaw in Netty's DefaultHttpRequest and DefaultFullHttpRequest classes allows bypassing request-line validation when the URI is later changed via setUri(). While the constructors reject control characters that could corrupt the start line, setUri() does not perform the same checks. When an attacker controls the input to setUri(), the unvalidated URI is written directly into the request line by HttpRequestEncoder and RtspEncoder, enabling CRLF injection and the insertion of additional HTTP or RTSP requests. This can lead to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side, exposing confidentiality, integrity, and availability risks.

The vulnerability affects the Netty networking library, specifically netty:netty. Versions prior to 4.2.13.Final and 4.1.133.Final are impacted. Applications that embed these older Netty releases are therefore at risk.

With a CVSS score of 5.3 the risk is moderate. Because the exploit requires execution of setUri() with attacker-controlled data, the attack surface includes services that accept user-supplied URIs. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nonetheless, the potential for request smuggling or injection warrants immediate attention.