Netty versions prior to 4.2.13.Final and 4.1.133.Final have a flaw in HttpProxyHandler where HTTP CONNECT requests are constructed with header validation turned off. The code adds user‑supplied outboundHeaders without checking for CRLF sequences, allowing an attacker who can influence these headers to inject arbitrary HTTP headers into a CONNECT request sent to a proxy server. This can alter the behavior of the proxy, potentially facilitating traffic manipulation or unauthorized access, though the overall risk is limited by the modest CVSS score of 2.9. This flaw corresponds to a Header Injection weakness (CWE‑113) and an Improper URL Construction weakness (CWE‑93).

The affected product is the Netty networking framework. Any deployment using Netty versions older than 4.2.13.Final or 4.1.133.Final is vulnerable, regardless of operating system or platform.

The CVSS score of 2.9 indicates low severity. The EPSS score of <1% shows a very low exploitation probability, and the issue is not listed in CISA KEV, suggesting it has not been widely exploited. The likely attack vector requires an attacker who can control or influence the outboundHeaders passed to HttpProxyHandler, such as an application‑side adversary. Successful exploitation would inject headers into the CONNECT request, potentially compromising traffic integrity or enabling further attacks via the proxy. Due to the low perceived impact, exploitation is considered unlikely under normal circumstances. This issue reflects a Header Injection (CWE‑113) and Improper URL Construction (CWE‑93) weakness.