CVE-2025-67735
published 2025-12-16CVE-2025-67735: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the…
PriorityP340medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.29%
21.1th percentile
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | netty | < netty 1:4.1.48-7+deb12u2 (bookworm) | netty 1:4.1.48-7+deb12u2 (bookworm) |
| netty | netty | < 4.1.129.Final | 4.1.129.Final |
| netty | netty | < 4.1.129 | 4.1.129 |
| netty | netty | — | — |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u3 | 1:4.1.48-4+deb11u3 |
| netty | netty | >= 0 < 1:4.1.48-7+deb12u2 | 1:4.1.48-7+deb12u2 |
| netty | netty | >= 0 < 1:4.1.48-10+deb13u1 | 1:4.1.48-10+deb13u1 |
| netty | netty | >= 0 < 1:4.1.48-16 | 1:4.1.48-16 |
| netty | netty | >= 4.2.0 < 4.2.8 | 4.2.8 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
ghsa·2026-05-07·CVSS 6.5
CVE-2026-42578 [MEDIUM] CWE-113 Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
# Security Vulnerability Report: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty
## 1. Vulnerability Summary
| Field | Value |
|-------|-------|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions) |
| **Component** | `io.netty.handler.proxy.HttpProxyHandler` |
| **Vulnerability Type** | CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers |
| **Impact** | HTTP Header Injection in CONNECT Proxy Requests |
| **CVSS 3.1 Score** | **7.5 (High)** |
| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |
| **Related Advisory** | **GHSA-84h7-rjj3-6jx4** (Incomplete Fix) |
## 2. Affected Components
- `io.netty
OSV
CVE-2025-67735: Netty is an asynchronous, event-driven network application framework
osv·2025-12-16·CVSS 6.5
CVE-2025-67735 [MEDIUM] CVE-2025-67735: Netty is an asynchronous, event-driven network application framework
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
GHSA
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
ghsa·2025-12-15
CVE-2025-67735 [MEDIUM] CWE-93 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
### Summary
The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the uri.
### Details
The `HttpRequestEncoder` simply UTF8 encodes the `uri` without sanitization (`buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8);`)
The default implementation of HTTP headers guards against such possibility already with a validator making it impossible with headers.
### PoC
Simple reproducer:
```java
public static void main(String[] args) {
EmbeddedChannel client = new EmbeddedChannel();
client.pipeline().addLast(new HttpClient
OSV
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
osv·2025-12-15
CVE-2025-67735 [MEDIUM] Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
### Summary
The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the uri.
### Details
The `HttpRequestEncoder` simply UTF8 encodes the `uri` without sanitization (`buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8);`)
The default implementation of HTTP headers guards against such possibility already with a validator making it impossible with headers.
### PoC
Simple reproducer:
```java
public static void main(String[] args) {
EmbeddedChannel client = new EmbeddedChannel();
client.pipeline().addLast(new HttpClient
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT) — CVE-2025-67735
vendor_oracle·2026-01-15·CVSS 6.5
CVE-2025-67735 [MEDIUM] Oracle Oracle Database Server Risk Matrix: Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT) — CVE-2025-67735
Oracle Oracle Database Server Risk Matrix: Oracle Graal Development Kit for Micronaut (Nimbus JOSE+JWT) vulnerability
CVE: CVE-2025-67735
CVSS: 6.5
Protocol: Oracle Net
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Red Hat
netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection
vendor_redhat·2025-12-16·CVSS 6.5
CVE-2025-67735 [MEDIUM] CWE-93 netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection
netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
A flaw was found in Netty (netty-codec-http). This vulnerability allows request smuggling via CRLF (Carriage Return Line Feed) injection with the request URI when constructing a
Debian
CVE-2025-67735: netty - Netty is an asynchronous, event-driven network application framework. In version...
vendor_debian·2025·CVSS 6.5
CVE-2025-67735 [MEDIUM] CVE-2025-67735: netty - Netty is an asynchronous, event-driven network application framework. In version...
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
Scope: local
bookworm: resolved (fixed in 1:4.1.48-7+deb12u2)
bullseye: resolved (fixed in 1:4.1.48-4+deb11u3)
forky: resolved (fixed in 1:4.1.48-16)
sid: resolved (fixed in 1:4.1.48-16)
trixie: resolved (fixed in 1:4.1.48-10+deb13u1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-67735 byte-buddy: Netty (netty-codec-http): Request Smuggling via CRLF Injection [fedora-42]
bugzilla·2025-12-17·CVSS 6.5
CVE-2025-67735 [MEDIUM] CVE-2025-67735 byte-buddy: Netty (netty-codec-http): Request Smuggling via CRLF Injection [fedora-42]
CVE-2025-67735 byte-buddy: Netty (netty-codec-http): Request Smuggling via CRLF Injection [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to
Wiz
CVE-2025-67735 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2025-67735 [MEDIUM] CVE-2025-67735 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-67735 :
Java vulnerability analysis and mitigation
io.netty.handler.codec.http.HttpRequestEncoder
HttpRequestEncoder
HttpRequestEncoder
Source : NVD
## 6.5
Score
Published December 16, 2025
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Java
Keycloak
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
elasticsearch-8.19
neo4j-2025.09
Sources
NVD
Chainguard Has Fix Added at: Dec 18, 2025
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Dec 18, 2025
Echo Severity MEDIUM Has Fix Added at: Dec 18, 2025
Maven Severity MEDIUM Has Fix Added at: Dec 16, 2025
MinimOS Severity MEDIUM Has Fi
2025-12-16
Published