CVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Modified

AliasesUBUNTU-CVE-2026-33870DEBIAN-CVE-2026-33870CGA-272w-8mr9-rwf5+756 more

Published 27-03-2026Last modified 15-09-2026

Vulnerability summary

CVE-2026-33870 is a high (CVSS 7.5) vulnerability in netty. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 53.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.70%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

OPENSUSE-SU-2026:10463-1 RHSA-2026:18054 RHSA-2026:18055 SUSE-SU-2026:1353-1 CGA-WF6R-M9M7-HVJF

Timeline

27-03-2026
PublishedVulnerability first disclosed.
15-09-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.70%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.70% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

akhq< 0.27.0-r0
apache-activemq-artemis< 2.53.0-r4
apache-camel-karavan-devmode< 4.14.2-r6 | < 4.14.2-r7
apache-pulsar-4.0< 4.0.9-r10
apache-pulsar-4.1< 4.1.3-r15

apache-pulsar-4.2< 4.2.1-r0
apache-pulsar-fips-4.0< 4.0.9-r10
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.1-r0
apicurio-registry< 3.2.0-r2
camunda-8.8< 8.8.22-r0
camunda-zeebe-8.6< 8.6.39-r0
camunda-zeebe-8.7< 8.7.27-r0
camunda-zeebe-8.8< 8.8.22-r0
celeborn-0.5< 0.5.4-r19
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r7 | < 0.6.2-r9
celeborn-0.7< 0.7.0-r3
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.18All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.15-r0
commercial-elasticsearch-9.0All versions (No fix recorded)
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3< 9.3.4-r0
druid< 36.0.0-r11
elasticsearch-7< 7.17.29-r12
elasticsearch-7-iamguarded< 7.17.29-r12
elasticsearch-8.17< 8.17.10-r20
elasticsearch-8.18All versions (No fix recorded)
elasticsearch-8.18-iamguardedAll versions (No fix recorded)
elasticsearch-8.19< 8.19.14-r1
elasticsearch-8.19-iamguarded< 8.19.14-r1
elasticsearch-9.0< 9.0.8-r9
elasticsearch-9.0-iamguarded< 9.0.8-r9
elasticsearch-9.1< 9.1.10-r3
elasticsearch-9.1-iamguarded< 9.1.10-r3
elasticsearch-9.2< 9.2.8-r1
elasticsearch-9.2-iamguarded< 9.2.8-r1
elasticsearch-9.3< 9.3.3-r1
elasticsearch-9.3-iamguarded< 9.3.3-r1
elasticsearch-fips-8.17< 8.17.10-r14
elasticsearch-fips-8.17-bitnami< 8.17.10-r14
elasticsearch-fips-8.18All versions (No fix recorded)
elasticsearch-fips-8.18-bitnamiAll versions (No fix recorded)
elasticsearch-fips-8.19< 8.19.13-r2
elasticsearch-fips-9.0< 9.0.8-r15
elasticsearch-fips-9.0-bitnami< 9.0.8-r15
elasticsearch-fips-9.1< 9.1.10-r7
elasticsearch-fips-9.2< 9.2.7-r2
elasticsearch-fips-9.3< 9.3.2-r2
flyway< 12.2.0-r1 | < 12.5.0-r0
flyway-fips< 12.2.0-r1
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r6
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded) | < 3.5.0-r3 | < 3.5.0-r12
hono-adapter-mqtt< 2.7.0-r6
hono-cli< 2.7.0-r6
hono-service-auth< 2.7.0-r6
hono-service-command-router< 2.7.0-r6
hono-service-device-registry-jdbc< 2.7.0-r6
infinispan-15.0< 15.0.22-r3
infinispan-15.1< 15.1.7-r10
infinispan-15.2< 15.2.6-r11
infinispan-16.0< 16.0.8-r1
infinispan-16.1< 16.1.2-r1
kafbat-ui< 1.4.2-r8
kafbat-ui-fips< 1.4.2-r7
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-bridge< 0.33.1-r12
kafka-bridge-fips< 0.33.1-r7
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.0< 2025.0.8-r10
kayenta-2025.1< 2025.1.6-r8
kayenta-2025.2< 2025.2.4-r4
kayenta-2025.4< 2025.4.3-r5
kayenta-2026.0< 2026.0.2-r5
kayenta-fips-2025.0< 2025.0.8-r12
kayenta-fips-2025.1< 2025.1.6-r9
kayenta-fips-2025.2< 2025.2.4-r5
kayenta-fips-2025.4< 2025.4.3-r6
kayenta-fips-2026.0< 2026.0.2-r6
keycloak-26.3-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4All versions (No fix recorded)
keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4-operatorAll versions (No fix recorded)
keycloak-26.5< 26.5.6-r2
keycloak-26.5-iamguarded-compat< 26.5.6-r2
keycloak-26.5-operator< 26.5.6-r2
keycloak-fips-26.3-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4All versions (No fix recorded)
keycloak-fips-26.4-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4-operatorAll versions (No fix recorded)
keycloak-fips-26.5< 26.5.6-r2
keycloak-fips-26.5-iamguarded-fips< 26.5.6-r2
keycloak-fips-26.5-operator< 26.5.6-r2
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r12
knative-kafka-broker-1.18-dispatcher-loom< 1.18.2-r6
knative-kafka-broker-1.18-receiver-loom< 1.18.2-r6
knative-kafka-broker-1.20-dispatcher-loom< 1.20.2-r6
knative-kafka-broker-1.21-dispatcher-loom< 1.21.1-r6
knative-kafka-broker-1.21-receiver-loom< 1.21.1-r6
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r1
knative-kafka-broker-fips-1.17-dispatcher-loom< 1.17.3-r2
knative-kafka-broker-fips-1.17-receiver-loom< 1.17.3-r2
knative-kafka-broker-fips-1.18-dispatcher-loom< 1.18.2-r2
knative-kafka-broker-fips-1.18-receiver-loom< 1.18.2-r2
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.2-r3
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.2-r3
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.1-r3
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.1-r3
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r1
kserve-modelmesh< 0.12.0-r33
localstack< 4.14.0-r10
logstash-8.17All versions (No fix recorded)
logstash-8.17-iamguarded-compatAll versions (No fix recorded)
logstash-8.17-with-output-opensearchAll versions (No fix recorded)
logstash-8.18All versions (No fix recorded)
logstash-8.18-iamguarded-compatAll versions (No fix recorded)
logstash-8.18-with-output-opensearchAll versions (No fix recorded)
logstash-8.19< 8.19.14-r0
logstash-8.19-iamguarded-compat< 8.19.14-r0
logstash-8.19-with-output-opensearch< 8.19.14-r0
logstash-9.0< 9.0.8-r24
logstash-9.0-iamguarded-compat< 9.0.8-r24
logstash-9.0-with-output-opensearch< 9.0.8-r24
logstash-9.1< 9.1.10-r8
logstash-9.1-bitnami-compat< 9.1.10-r8
logstash-9.1-iamguarded-compat< 9.1.10-r8
logstash-9.1-with-output-opensearch< 9.1.10-r8
logstash-9.2< 9.2.8-r0
logstash-9.2-iamguarded-compat< 9.2.8-r0
logstash-9.2-with-output-opensearch< 9.2.8-r0
logstash-9.3< 9.3.3-r0
logstash-9.3-iamguarded-compat< 9.3.3-r0
logstash-9.3-with-output-opensearch< 9.3.3-r0
management-api-for-apache-cassandra-4.0< 0.1.114-r0
management-api-for-apache-cassandra-4.1< 0.1.114-r0
management-api-for-apache-cassandra-5.0< 0.1.114-r1
neo4j-2025.08All versions (No fix recorded)
neo4j-2025.09All versions (No fix recorded)
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.11All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r4
neo4j-4.4All versions (No fix recorded)
neo4j-5.26< 5.26.23-r1
opensearch-2< 2.19.4-r13
opensearch-2-ml-commons< 2.19.4-r13
opensearch-2-performance-analyzer< 2.19.4-r13
opensearch-2-repository-azure< 2.19.4-r13
opensearch-2-repository-s3< 2.19.4-r13
opensearch-2-security< 2.19.4-r13
opensearch-2-transport-nio< 2.19.4-r13
opensearch-3< 3.5.0-r3 | < 3.6.0-r0
opensearch-3-ml-commons< 3.5.0-r3 | < 3.6.0-r0
opensearch-3-notifications< 3.5.0-r3
opensearch-3-performance-analyzer< 3.5.0-r3
opensearch-3-repository-azure< 3.6.0-r0 | < 3.5.0-r3
opensearch-3-repository-s3< 3.5.0-r3
opensearch-3-security< 3.5.0-r3
opensearch-3-security-analytics< 3.6.0-r0
opensearch-fips-3< 3.5.0-r5
opensearch-fips-3-ml-commons< 3.6.0-r0 | < 3.5.0-r5
opensearch-fips-3-notifications< 3.5.0-r5
opensearch-fips-3-performance-analyzer< 3.5.0-r5
opensearch-fips-3-repository-azure< 3.5.0-r5
opensearch-fips-3-repository-s3< 3.5.0-r5
opensearch-fips-3-security< 3.5.0-r5
opensearch-fips-3-security-analytics< 3.6.0-r0
pinot< 1.4.0-r4
pinot-fips< 1.4.0-r1
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r2
seata-server< 2.6.0-r6
sonarqube< 26.7.0.124771-r0
spark-3.5-scala-2.12< 3.5.8-r10
spark-3.5-scala-2.13< 3.5.8-r10
spark-4.0-scala-2.13< 4.0.2-r9
spark-4.1-scala-2.13< 4.1.1-r10
spark-fips-3.5-scala-2.12< 3.5.8-r0
spark-fips-3.5-scala-2.13< 3.5.8-r0
spark-fips-4.1-scala-2.13< 4.1.1-r8
strimzi-kafka-operator< 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r5 | < 0.51.0-r6
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 0.51.0-r6
strimzi-kafka-operator-kafka-baseAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-kafka-init< 0.51.0-r6 | < 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.51.0-r7 | < 0.51.0-r22 | < 1.2.0-r5
strimzi-kafka-operator-topic-operator< 1.2.0-r5 | < 0.51.0-r6
strimzi-kafka-operator-tracing-agent< 0.51.0-r6 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 0.51.0-r6
tez< 0.10.5-r10
thingsboard-tb-mqtt-transport< 4.3.1-r4