GHSA-pwqr-wmgm-9rr8 — Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Affected: Maven: io.netty:netty-codec-http

## Summary

Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.

## Background

This vulnerability is a new variant discovered during research into the "Funky Chunks" HTTP request smuggling techniques:

- <https://w4ke.info/2025/06/18/funky-chunks.html> - <https://w4ke.info/2025/10/29/funky-chunks-2.html>

The original research tested various chunk extension parsing differentials but did not cover quoted-string handling within extension values.

## Technical Details

**RFC 9110 Section 7.1.1** defines chunked transfer encoding:

``` chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] ) chunk-ext-val = token / quoted-string ```

**RFC 9110 Section 5.6.4** defines quoted-string:

``` quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE ```

Critically, the allowed character ranges within a quoted-string are:

``` qdtext = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text ) ```

CR (`%x0D`) and LF (`%x0A`) bytes fall outside all of these ranges and are therefore **not permitted** inside chunk extensions—whether quoted or unquoted. A strictly compliant parser should reject any request containing CR or LF bytes before the actual line terminator within a chunk extension with a `400 Bad Request` response (as Squid does, for example).

## Vulnerability

Netty terminates chunk header…

Most recent entries from all

GHSA-pwqr-wmgm-9rr8 — Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing