CVE-2025-67735
📋 TL;DR
This CVE describes a CRLF injection vulnerability in Netty's HttpRequestEncoder that allows request smuggling. Attackers can inject malicious content into HTTP requests to bypass security controls or poison caches. Any application or framework using HttpRequestEncoder without proper URI sanitization is affected.
💻 Affected Systems
- Netty
📦 What is this software?
Netty by Netty
Netty by Netty
⚠️ Risk & Real-World Impact
Worst Case
Attackers could perform request smuggling to bypass security controls, poison caches, perform web cache poisoning, or conduct cross-user attacks in multi-user applications.
Likely Case
Request smuggling leading to cache poisoning, security control bypass, or injection of malicious content into HTTP responses.
If Mitigated
Limited impact with proper input validation and sanitization in place, though the underlying vulnerability remains.
🎯 Exploit Status
Exploitation requires understanding of HTTP request smuggling techniques and CRLF injection. The advisory provides technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.129.Final or 4.2.8.Final
Vendor Advisory: https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
Restart Required: Yes
Instructions:
1. Identify Netty version in your application. 2. Update Netty dependency to 4.1.129.Final (for 4.1.x) or 4.2.8.Final (for 4.2.x). 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization of HTTP request URIs before they reach HttpRequestEncoder.
WAF Configuration
allConfigure Web Application Firewall to detect and block CRLF injection attempts in HTTP requests.
🧯 If You Can't Patch
- Implement strict input validation and sanitization of all HTTP request URIs
- Deploy WAF with CRLF injection detection rules and monitor for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check Netty version in your application dependencies. If using Maven: mvn dependency:tree | grep netty. If using Gradle: gradle dependencies | grep netty.Check Version:
For Java applications: System.out.println(io.netty.util.Version.identify());Verify Fix Applied:
Verify Netty version is 4.1.129.Final or higher (for 4.1.x) or 4.2.8.Final or higher (for 4.2.x) after update.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP request patterns with CRLF sequences in URIs
- Multiple requests with same parameters but different outcomes
- Cache poisoning indicators
Network Indicators:
- HTTP requests containing %0D%0A or \r\n sequences in URIs
- Request smuggling patterns in HTTP traffic
SIEM Query:
http.uri contains "%0D%0A" OR http.uri contains "\r\n"