Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final contain a CWE‑444 weakness that allows attackers to bypass final transfer coding validation in the Transfer‑Encoding header. By sending headers split across lines or appending values such as "chunked, xchunked", the library incorrectly treats the message as chunked even when the last coding is not, enabling an attacker to smuggle requests. The result is that an adversary can hide malicious payloads, alter request semantics, or subvert downstream services, potentially leading to unauthorized data access or protocol abuse.

All applications or services that incorporate Netty 4.1.133.Final–4.1.137.Final or 4.2.13.Final–4.2.17.Final are vulnerable. No other Netty releases are affected. The affected product is the Netty network application framework, offered by the netty:netty vendor.

The CVSS score of 6.9 indicates moderate severity, and while the EPSS score is currently unavailable, HTTP request smuggling flaws have a known history of exploitation due to the simple construction of malformed headers. The vulnerability is not listed in the CISA KEV catalog, suggesting no active exploitation campaigns are documented. Attackers can remotely send crafted HTTP requests to any vulnerable Netty‑ injection, denial of service, or privilege escalation depending on the application context.