GHSA-pwqr-wmgm-9rr8 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
SummaryNetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.BackgroundThis vulnerability is a new variant discovered during research into the "Funky Chunks" HTTP request smuggling techniques:<https://w4ke.info/2025/06/18/funky-chunks.html><https://w4ke.info/2025/10/29/funky-chunks-2.html>The original research tested various chunk extension parsing differentials but did not cover quoted-string handling within extension values.Technical Details**RFC 9110 Section 7.1.1** defines chunked transfer encoding:**RFC 9110 Section 5.6.4** defines quoted-string:Critically, the allowed character ranges within a quoted-string are:CR (`%x0D`) and LF (`%x0A`) bytes fall outside all of these ranges and are therefore **not permitted** inside chunk extensions—whether quoted or unquoted. A strictly compliant parser should reject any request containing CR or LF bytes before the actual line terminator within a chunk extension with a `400 Bad Request` response (as Squid does, for example).VulnerabilityNetty terminates chunk header parsing at `\r\n` inside quoted strings instead of rejecting the request as malformed. This creates a parsing differential between Netty and RFC-compliant parsers, which can be exploited for request smuggling.**Expected behavior (RFC-compliant):**
A request containing CR/LF bytes within a chunk extension value should be rejected outright as invalid.**Actual behavior (Netty):**The root cause is that Netty does not validate that CR/LF bytes are forbidden inside chunk extensions before the terminating CRLF. Rather than attempting to parse through quoted strings, the appropriate fix is to reject such requests entirely.Proof of Concept**Result:** The server returns two HTTP responses from a single TCP connection, confirming request smuggling.Parsing Breakdown| Parser                | Request 1         | Request 2                          |
|-----------------------|-------------------|------------------------------------|
| Netty (vulnerable)    | POST / body="X"  | GET /smuggled (SMUGGLED)           |
| RFC-compliant parser  | 400 Bad Request   | (none — malformed request rejected)|Impact**Request Smuggling**: An attacker can inject arbitrary HTTP requests into a connection.**Cache Poisoning**: Smuggled responses may poison shared caches.**Access Control Bypass**: Smuggled requests can circumvent frontend security controls.**Session Hijacking**: Smuggled requests may intercept responses intended for other users.ReproductionStart the minimal proof-of-concept environment using the provided Docker configuration.Execute the proof-of-concept script included in the attached archive.Suggested FixThe parser should reject requests containing CR or LF bytes within chunk extensions rather than attempting to interpret them:AcknowledgmentsCredit to Ben Kallus for clarifying the RFC interpretation during discussion on the HAProxy mailing list.Resources[RFC 9110: HTTP Semantics (Sections 5.6.4, 7.1.1)](https://www.rfc-editor.org/rfc/rfc9110)[Funky Chunks Research](https://w4ke.info/2025/06/18/funky-chunks.html)[Funky Chunks 2 Research](https://w4ke.info/2025/10/29/funky-chunks-2.html)Attachments![Vulnerability Diagram](https://github.com/user-attachments/assets/2faaa23e-693b-4efc-afb7-aae1d4101e7e)[java_netty.zip](https://github.com/user-attachments/files/24697955/java_netty.zip)
CVSS v3.1 score: 7.5