CVE-2025-67735

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.32%• Percentile: 25%

Techniques & Countermeasures

• CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')

  The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected Systems

• chainguard•akhq

  < 0.26.0-r4

• chainguard•apache-activemq-artemis

  < 2.44.0-r1

• chainguard•apache-activemq-artemis-compat

  < 2.44.0-r1

• chainguard•apache-hop

  < 2.16.0-r1

• chainguard•apache-hop-fips

  < 2.16.0-r1

• chainguard•apache-nifi

  < 2.7.2-r0

• chainguard•apache-nifi-compat

  < 2.7.2-r0

• chainguard•apache-nifi-registry

  < 2.7.2-r0

• chainguard•apache-nifi-registry-toolkit

  < 2.7.2-r0

• chainguard•apache-nifi-toolkit

  < 2.7.2-r0

• chainguard•apache-pulsar

  < 4.1.2-r1

• chainguard•apache-pulsar-compat

  < 4.1.2-r1

• chainguard•apicurio-registry

  < 3.1.4-r3

• chainguard•camunda-zeebe-8.6

  < 8.6.34-r1

• chainguard•camunda-zeebe-8.6-compat

  < 8.6.34-r1

• chainguard•camunda-zeebe-8.7

  < 8.7.21-r1

• chainguard•camunda-zeebe-8.7-compat

  < 8.7.21-r1

• chainguard•camunda-zeebe-8.8

  < 8.8.8-r1

• chainguard•camunda-zeebe-8.8-compat

  < 8.8.8-r1

• chainguard•celeborn-0.5

  < 0.5.4-r11 | < 0.5.4-r19 | < 0.5.4-r13

• chainguard•celeborn-0.6

  < 0.6.2-r7 | < 0.6.3-r7 | < 0.6.2-r6 | all

• chainguard•celeborn-0.7

  all

• chainguard•commercial-elasticsearch-8.17

  all

• chainguard•commercial-elasticsearch-8.18

  all

• chainguard•commercial-elasticsearch-9.0

  all

• chainguard•docker-selenium-base

  < 4.39.0.20251202-r1

• chainguard•druid

  < 35.0.1-r1

• chainguard•elasticsearch-7

  < 7.17.29-r6

• chainguard•elasticsearch-7-iamguarded

  < 7.17.29-r6

• chainguard•elasticsearch-8.17

  < 8.17.10-r15

• chainguard•elasticsearch-8.17-config

  < 8.17.10-r15

• chainguard•elasticsearch-8.18

  < 8.18.8-r2

• chainguard•elasticsearch-8.18-config

  < 8.18.8-r2

• chainguard•elasticsearch-8.18-iamguarded

  < 8.18.8-r2

• chainguard•elasticsearch-8.19

  < 8.19.8-r1

• chainguard•elasticsearch-8.19-config

  < 8.19.8-r1

• chainguard•elasticsearch-8.19-iamguarded

  < 8.19.8-r1

• chainguard•elasticsearch-9.0

  < 9.0.8-r2

• chainguard•elasticsearch-9.0-config

  < 9.0.8-r2

• chainguard•elasticsearch-9.0-iamguarded

  < 9.0.8-r2

• chainguard•elasticsearch-9.1

  < 9.1.8-r1

• chainguard•elasticsearch-9.1-config

  < 9.1.8-r1

• chainguard•elasticsearch-9.1-iamguarded

  < 9.1.8-r1

• chainguard•elasticsearch-9.2

  < 9.2.2-r1

• chainguard•elasticsearch-9.2-config

  < 9.2.2-r1

• chainguard•elasticsearch-9.2-iamguarded

  < 9.2.2-r1

• chainguard•elasticsearch-fips-8.17

  < 8.17.10-r3

• chainguard•elasticsearch-fips-8.17-bitnami

  < 8.17.10-r3

• chainguard•elasticsearch-fips-8.17-config

  < 8.17.10-r3

• chainguard•elasticsearch-fips-8.18

  < 8.18.8-r3

Showing first 50 affected entries in server-rendered view.

References (9)

• https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
• https://nvd.nist.gov/vuln/detail/CVE-2025-67735
• https://github.com/netty/netty/commit/77e81f1e5944d98b3acf887d3aa443b252752e94
• https://github.com/netty/netty
• https://security-tracker.debian.org/tracker/CVE-2025-67735
• https://ubuntu.com/security/CVE-2025-67735
• https://www.cve.org/CVERecord?id=CVE-2025-67735
• https://ubuntu.com/security/notices/USN-8654-1
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67735.json