CVE-2025-67735 - CVE House
Back to Database
Status published Medium CVE-2025-67735

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Vulnerability Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67735

Credits & Attribution

No credits recorded in the NVD database.

References

More from netty

View All →
CVE-2025-59419
Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Medium 5.5
CVE-2025-58057
Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Medium 6.9
CVE-2025-58056
Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Low 2.9
CVE-2025-55163
Netty MadeYouReset HTTP/2 DDoS Vulnerability
High 8.2
CVE-2025-29908
Netty QUIC hash collision DoS attack
Medium 5.3

Affected Vendor

Affected Software

netty
Vulnerable Versions:
>= 4.2.0.Alpha1, < 4.2.8.Final, < 4.1.129.Final

Timeline

Official Publish: December 16th, 2025
Last Modified: December 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-93

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.