GHSA-45q3-82m4-75jr: Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)
Security Vulnerability Report: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty1. Vulnerability Summary| Field | Value |
|-------|-------|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions) |
| **Component** | `io.netty.handler.proxy.HttpProxyHandler` |
| **Vulnerability Type** | CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers |
| **Impact** | HTTP Header Injection in CONNECT Proxy Requests |
| **CVSS 3.1 Score** | **7.5 (High)** |
| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |
| **Related Advisory** | **GHSA-84h7-rjj3-6jx4** (Incomplete Fix) |2. Affected Components`io.netty.handler.proxy.HttpProxyHandler` — `newInitialMessage()` method (line 176) explicitly disables header validation via `withValidation(false)`3. Vulnerability DescriptionNetty's `HttpProxyHandler` constructs HTTP CONNECT requests with **header validation explicitly disabled**. The `newInitialMessage()` method (line 176) creates headers using `DefaultHttpHeadersFactory.headersFactory().withValidation(false)`, then adds user-provided `outboundHeaders` (line 188-190) without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server.Root CauseThe `outboundHeaders` parameter comes from the `HttpProxyHandler` constructor (lines 80-93, 99-127), which is supplied by application code.Incomplete Fix of GHSA-84h7-rjj3-6jx4**This vulnerability represents an incomplete fix of the previously acknowledged security advisory [GHSA-84h7-rjj3-6jx4](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4).**The GHSA-84h7-rjj3-6jx4 fix addressed HTTP CRLF injection by adding URI validation via `validateRequestLineTokens()` in `DefaultHttpRequest` and enabling header validation by default through `DefaultHttpHeadersFactory`. However, `HttpProxyHandler` **explicitly opts out** of the fix by calling `withValidation(false)`, creating a gap where:The GHSA-84h7-rjj3-6jx4 fix's header validation is bypassedUser-provided `outboundHeaders` are added without any CRLF checkThe resulting CONNECT request contains unvalidated headers on the wireThis is not a new vulnerability class — it is the **same CRLF injection** that GHSA-84h7-rjj3-6jx4 was supposed to fix, but `HttpProxyHandler` was missed during the remediation. The fix for GHSA-84h7-rjj3-6jx4 should be extended to cover this code path.4. Exploitability PrerequisitesThis vulnerability is exploitable when:An application uses `HttpProxyHandler` with user-influenced `outboundHeaders`The application does not perform its own CRLF sanitization on header values**Common affected patterns**:HTTP proxy clients that forward user-specified custom headersWeb scraping frameworks that allow users to set proxy headersAPI gateways that pass user headers through a proxy tunnel5. Attack ScenariosScenario 1: Proxy Authentication Bypass**Attack input**: `userInput = "1.2.3.4\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4="`**Wire format**:The injected `Proxy-Authorization` header may override or supplement the original authentication, potentially granting access to a restricted proxy.Scenario 2: Request Smuggling via Proxy**Attack input**: `userInput = "value\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nGET /internal HTTP/1.1\r\nHost: internal-service"`Injects a full smuggled request through the proxy tunnel establishment.6. Proof of ConceptFull Runnable PoC Source Code (HttpProxyHeaderInjectionPoC.java)PoC Execution Output (Verified on Netty 4.2.12.Final)7. Remediation RecommendationsOption 1: Remove withValidation(false)Option 2: Validate outboundHeaders Before Adding8. Resources[GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection (**incomplete fix — this report**)](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)
CVSS v4.0: 2.9