Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-89044 is a vulnerability classified as Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), affecting netty (affected versions: 4.1.133.Final – < 4.1.138.Final and 4.2.13.Final – < 4.2.18.Final). This vulnerability is rated Medium, with a CVSS score of 6.9. There is not enough data to determine whether this vulnerability has been exploited.
Analyzing data...
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
