CRLF Injection Vulnerability in Netty's HttpRequestEncoder
Summary
GHSA-84h7-rjj3-6jx4: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder. Affects io.netty:netty-codec-http across 2 version ranges.
< 4.1.129.Final
>= 4.2.0.Alpha1, < 4.2.8.Final
Fixed in 4.1.129.Final or 4.2.8.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular open-source framework that provides asynchronous event-driven network application development. It simplifies the process of building high-performance network applications such as protocol servers and clients. The 'io.netty.handler.codec.http.HttpRequestEncoder' is a component responsible for encoding HTTP requests. However, it has been found to be vulnerable to CRLF (Carriage Return Line Feed) injection, which can lead to serious security issues such as request smuggling.
Vulnerability Detail
The vulnerability arises from the way the HttpRequestEncoder handles the request URI. It encodes the URI using UTF-8 without proper sanitization, allowing an attacker to inject CRLF sequences into the request. This can lead to request smuggling, where an attacker can manipulate the HTTP request to bypass security controls or confuse the server into processing multiple requests as one. The default HTTP headers implementation has safeguards against such injections, but the URI handling lacks these protections, making it a critical area of concern.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.129.Final4.1.129.Final -
>= 4.2.0.Alpha1, < 4.2.8.Final4.2.8.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any user input used in the URI is properly sanitized to remove CRLF characters before passing it to the HttpRequestEncoder. This can be done by implementing a validation method that checks for and removes any CRLF sequences from the input string.
Conclusion
The CRLF injection vulnerability in Netty's HttpRequestEncoder poses a significant risk to applications using this library. It is crucial to update to the patched versions to safeguard against potential exploitation. Additionally, implementing input sanitization can provide a temporary solution until the update is applied.
See every vulnerability recorded for io.netty:netty-codec-http →
FAQ
CRLF injection is a type of attack where an attacker injects CRLF characters into a request, which can manipulate how the server interprets the request, potentially leading to security vulnerabilities like request smuggling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application against this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can lead to request smuggling, allowing attackers to bypass security measures, manipulate server responses, or perform unauthorized actions.
Yes, patches are available in versions 4.2.8.Final and 4.1.129.Final of the netty-codec-http package. It is recommended to update to these versions or later.
If you cannot update immediately, implement input sanitization to remove CRLF characters from any user input used in the URI to mitigate the risk temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec-http.
