THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-33870 (HIGH 7.5) — Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final an

[NVD] CVE-2026-33870 (HIGH 7.5) — Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final an

lownvdPublished 2026-03-27

CVE-2026-33870 CVSS: 7.5 HIGH Published: 2026-03-27T20:16:34.663

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Indicators of compromise

CVE-2026-33870cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-33870