CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Analyzed

AliasesSUSE-SU-2025:4489-1UBUNTU-CVE-2025-67735DEBIAN-CVE-2025-67735+875 more

Published 16-12-2025Last modified 16-12-2025

Vulnerability summary

CVE-2025-67735 is a medium (CVSS 6.5) vulnerability in netty. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 25% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.32%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

16-12-2025
PublishedVulnerability first disclosed.
16-12-2025
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.16.5

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.32% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

CWE-93Improper Neutralization of CRLF SequencesThe product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

akhq< 0.26.0-r4
apache-activemq-artemis< 2.44.0-r1
apache-activemq-artemis-compat< 2.44.0-r1
apache-hop< 2.16.0-r1
apache-hop-fips< 2.16.0-r1

apache-nifi< 2.7.2-r0
apache-nifi-compat< 2.7.2-r0
apache-nifi-registry< 2.7.2-r0
apache-nifi-registry-toolkit< 2.7.2-r0
apache-nifi-toolkit< 2.7.2-r0
apache-pulsar< 4.1.2-r1
apache-pulsar-compat< 4.1.2-r1
apicurio-registry< 3.1.4-r3
camunda-zeebe-8.6< 8.6.34-r1
camunda-zeebe-8.6-compat< 8.6.34-r1
camunda-zeebe-8.7< 8.7.21-r1
camunda-zeebe-8.7-compat< 8.7.21-r1
camunda-zeebe-8.8< 8.8.8-r1
camunda-zeebe-8.8-compat< 8.8.8-r1
celeborn-0.5< 0.5.4-r11 | < 0.5.4-r19 | < 0.5.4-r13
celeborn-0.6< 0.6.2-r7 | < 0.6.3-r7 | < 0.6.2-r6 | All versions (No fix recorded)
celeborn-0.7< 0.7.0-r3
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.18All versions (No fix recorded)
commercial-elasticsearch-9.0All versions (No fix recorded)
docker-selenium-base< 4.39.0.20251202-r1
druid< 35.0.1-r1
elasticsearch-7< 7.17.29-r6
elasticsearch-7-iamguarded< 7.17.29-r6
elasticsearch-8.17< 8.17.10-r15
elasticsearch-8.17-config< 8.17.10-r15
elasticsearch-8.18< 8.18.8-r2
elasticsearch-8.18-config< 8.18.8-r2
elasticsearch-8.18-iamguarded< 8.18.8-r2
elasticsearch-8.19< 8.19.8-r1
elasticsearch-8.19-config< 8.19.8-r1
elasticsearch-8.19-iamguarded< 8.19.8-r1
elasticsearch-9.0< 9.0.8-r2
elasticsearch-9.0-config< 9.0.8-r2
elasticsearch-9.0-iamguarded< 9.0.8-r2
elasticsearch-9.1< 9.1.8-r1
elasticsearch-9.1-config< 9.1.8-r1
elasticsearch-9.1-iamguarded< 9.1.8-r1
elasticsearch-9.2< 9.2.2-r1
elasticsearch-9.2-config< 9.2.2-r1
elasticsearch-9.2-iamguarded< 9.2.2-r1
elasticsearch-fips-8.17< 8.17.10-r3
elasticsearch-fips-8.17-bitnami< 8.17.10-r3
elasticsearch-fips-8.17-config< 8.17.10-r3
elasticsearch-fips-8.18< 8.18.8-r3
elasticsearch-fips-8.18-bitnami< 8.18.8-r3
elasticsearch-fips-8.18-config< 8.18.8-r3
elasticsearch-fips-8.19< 8.19.8-r2
elasticsearch-fips-8.19-config< 8.19.8-r2
elasticsearch-fips-9.0< 9.0.8-r2
elasticsearch-fips-9.0-bitnami< 9.0.8-r2
elasticsearch-fips-9.0-config< 9.0.8-r2
elasticsearch-fips-9.1< 9.1.8-r2
elasticsearch-fips-9.1-config< 9.1.8-r2
elasticsearch-fips-9.2< 9.2.2-r2
elasticsearch-fips-9.2-config< 9.2.2-r2
flyway< 12.5.0-r0 | < 11.19.0-r1
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r6
hadoop-fips-3.3.6< 3.3.6-r16 | All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r5 | < 3.5.0-r12
infinispan-15.0< 15.0.21-r2
infinispan-15.0-compat< 15.0.21-r2
infinispan-15.0-images< 15.0.21-r2
infinispan-15.1< 15.1.7-r4
infinispan-15.1-compat< 15.1.7-r4
infinispan-15.1-images< 15.1.7-r4
infinispan-15.2< 15.2.6-r2
infinispan-15.2-compat< 15.2.6-r2
infinispan-15.2-images< 15.2.6-r2
kafbat-ui< 1.4.2-r1
kafbat-ui-compat< 1.4.2-r1
kafka_exporter-strimzi-compat< 1.2.0-r5 | All versions (No fix recorded)
kafka-bridge< 0.33.1-r6
kafka-bridge-fips< 0.33.1-r1
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.0< 2025.0.8-r4
kayenta-2025.1< 2025.1.6-r1
kayenta-2025.2< 2025.2.3-r1
kayenta-fips-2025.0< 2025.0.8-r4
kayenta-fips-2025.1< 2025.1.6-r1
kayenta-fips-2025.2< 2025.2.3-r1
keycloak-26.2< 26.2.5-r8
keycloak-26.2-compat< 26.2.5-r8
keycloak-26.2-iamguarded-compat< 26.2.5-r8
keycloak-26.3-iamguarded-compat< 26.3.5-r5
keycloak-26.4< 26.4.7-r1
keycloak-26.4-compat< 26.4.7-r1
keycloak-26.4-iamguarded-compat< 26.4.7-r1
keycloak-26.4-operator< 26.4.7-r1
keycloak-26.4-operator-compat< 26.4.7-r1
keycloak-fips-26.2-iamguarded-fips< 26.2.5-r10
keycloak-fips-26.3-iamguarded-fips< 26.3.5-r6
keycloak-fips-26.4< 26.4.7-r13
keycloak-fips-26.4-iamguarded-fips< 26.4.7-r13
keycloak-fips-26.4-operator< 26.4.7-r13
keycloak-fips-26.4-operator-compat< 26.4.7-r13
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r11
knative-kafka-broker-1.17-receiver-loom< 1.17.3-r11
knative-kafka-broker-1.18-dispatcher-loom< 1.18.2-r4
knative-kafka-broker-1.18-receiver-loom< 1.18.2-r4
knative-kafka-broker-1.20-dispatcher-loom< 1.20.2-r4
knative-kafka-broker-1.20-receiver-loom< 1.20.2-r4
knative-kafka-broker-1.21-dispatcher-loom< 1.21.1-r4
knative-kafka-broker-1.21-receiver-loom< 1.21.1-r4
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r1
kserve-modelmesh< 0.12.0-r19
kserve-modelmesh-compat< 0.12.0-r19
localstack< 4.12.0-r0 | < 4.14.0-r6
logstash-8.17All versions (No fix recorded) | < 8.17.10-r6
logstash-8.17-compat< 8.17.10-r6
logstash-8.17-env2yaml< 8.17.10-r6
logstash-8.17-iamguarded-compatAll versions (No fix recorded) | < 8.17.10-r6
logstash-8.17-with-output-opensearch< 8.17.10-r6 | All versions (No fix recorded)
logstash-8.18< 8.18.8-r17 | < 8.18.8-r4
logstash-8.18-compat< 8.18.8-r4
logstash-8.18-env2yaml< 8.18.8-r4
logstash-8.18-iamguarded-compat< 8.18.8-r4 | < 8.18.8-r17
logstash-8.18-with-output-opensearch< 8.18.8-r17 | < 8.18.8-r4
logstash-8.19< 8.19.8-r2
logstash-8.19-compat< 8.19.8-r2
logstash-8.19-env2yaml< 8.19.8-r2
logstash-8.19-iamguarded-compat< 8.19.8-r2
logstash-8.19-with-output-opensearch< 8.19.8-r2
logstash-9.0< 9.0.8-r17 | < 9.0.8-r5
logstash-9.0-compat< 9.0.8-r5
logstash-9.0-env2yaml< 9.0.8-r5
logstash-9.0-iamguarded-compat< 9.0.8-r17 | < 9.0.8-r5
logstash-9.0-with-output-opensearch< 9.0.8-r5 | < 9.0.8-r17
logstash-9.1< 9.1.8-r1
logstash-9.1-bitnami-compat< 9.1.8-r1
logstash-9.1-compat< 9.1.8-r1
logstash-9.1-env2yaml< 9.1.8-r1
logstash-9.1-iamguarded-compat< 9.1.8-r1
logstash-9.1-with-output-opensearch< 9.1.8-r1
logstash-9.2< 9.2.2-r1
logstash-9.2-compat< 9.2.2-r1
logstash-9.2-env2yaml< 9.2.2-r1
logstash-9.2-iamguarded-compat< 9.2.2-r1
logstash-9.2-with-output-opensearch< 9.2.2-r1
logstash-input-http< 3.10.4-r0
management-api-for-apache-cassandra-4.0< 0.1.111-r1
management-api-for-apache-cassandra-4.0-compat< 0.1.111-r1
management-api-for-apache-cassandra-4.1< 0.1.111-r1
management-api-for-apache-cassandra-4.1-compat< 0.1.111-r1
management-api-for-apache-cassandra-5.0< 0.1.111-r1
management-api-for-apache-cassandra-5.0-compat< 0.1.111-r1
neo4j-2025.07All versions (No fix recorded)
neo4j-2025.08All versions (No fix recorded)
neo4j-2025.09< 2025.09.0-r8
neo4j-2025.09-browser< 2025.09.0-r4
neo4j-2025.09-docker-publish< 2025.09.0-r4
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.10-browser< 2025.10.1-r2
neo4j-2025.10-docker-publish< 2025.10.1-r2
neo4j-2025.11All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded)
neo4j-4.4< 4.4.46-r3
neo4j-4.4-docker-publish< 4.4.46-r3
neo4j-5.26-docker-publish< 5.26.18-r1
opensearch-2< 2.19.4-r3
opensearch-2-ml-commons< 2.19.4-r6
opensearch-2-performance-analyzer< 2.19.4-r6
opensearch-2-repository-azure< 2.19.4-r3
opensearch-2-repository-s3< 2.19.4-r3
opensearch-2-security< 2.19.4-r6
opensearch-2-security-analytics< 2.19.4-r6
opensearch-2-transport-nio< 2.19.4-r3
opensearch-3< 3.4.0-r0
opensearch-3-ml-commons< 3.5.0-r0
opensearch-3-notifications< 3.5.0-r0
opensearch-3-performance-analyzer< 3.5.0-r0
opensearch-3-repository-azure< 3.4.0-r0
opensearch-3-repository-s3< 3.4.0-r0
opensearch-3-security< 3.5.0-r0
opensearch-3-security-analytics< 3.5.0-r0
opensearch-fips-3-ml-commons< 3.5.0-r0
opensearch-fips-3-notifications< 3.5.0-r0
opensearch-fips-3-performance-analyzer< 3.5.0-r0
opensearch-fips-3-security< 3.5.0-r0
opensearch-fips-3-security-analytics< 3.5.0-r0
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
seata< 2.5.0-r4
seata-openjdk-17-compat< 2.5.0-r4
seata-openjdk-21-compat< 2.5.0-r4
seata-openjdk-8-compat< 2.5.0-r4
seata-server< 2.5.0-r4
seata-server-oci-entrypoint< 2.5.0-r4
sonarqube< 25.12.0.117093-r1 | < 26.2.0.119303-r2
spark-3.5< 3.5.7-r4
spark-3.5-scala-2.12< 3.5.7-r4

Show all 200

1 vendor · 200 products · Showing 200 of 426

References

12 links

github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
www.suse.com/support/update/announcement/2025/suse-su-20254489-1/Advisory
bugzilla.suse.com/1255048REPORT
www.suse.com/security/cve/CVE-2025-67735WEB
ubuntu.com/security/CVE-2025-67735REPORT
www.cve.org/CVERecord?id=CVE-2025-67735REPORT
ubuntu.com/security/notices/USN-8654-1Advisory
security-tracker.debian.org/tracker/CVE-2025-67735Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67735.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-67735Advisory

Show all 12 references