Netty’s HttpObjectDecoder discards any ISO control character and whitespace before parsing the first request line. This behavior exceeds the specification from RFC 9112, which only requires ignoring empty CRLF lines. By swallowing non‑CRLF control bytes, the decoder can misalign the boundaries of pipelined or multiplexed HTTP connections, potentially causing a front‑end component that treats those bytes differently to misinterpret the request stream. The impact is a confusion of request boundaries, which can affect subsequent request handling.

The Java networking library Netty is affected in all versions prior to 4.1.135.Final and 4.2.15.Final. Netty is widely used across many Java servers, frameworks, and microservices. Any application that depends on a vulnerable Netty build inherits the flaw.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a client or intermediary sending ISO control bytes or non-CRLF whitespace before the HTTP request line; the attacker would need to control the transport layer to insert those bytes. Because exploitation requires sending specially crafted control characters to a server that uses Netty, the overall risk remains moderate.