{"action":"Upgrade io.netty:netty-codec-http to 4.1.132.Final (4.1.x) or 4.2.10.Final (4.2.x) or later.","affected":[{"fixed":"4.1.132.Final","introduced":"0"},{"fixed":"4.2.10.Final","introduced":"4.2.0.Alpha1"}],"component":"io.netty:netty-codec-http","cve_ids":["CVE-2026-33870"],"ecosystem":"Maven","epss":0.00701,"exploited":false,"fixed_versions":["4.1.132.Final","4.2.10.Final"],"ghsa_id":"GHSA-pwqr-wmgm-9rr8","id":"tcs_01M5N986V7J5YTA4KRW68ZNNM4","modified_at":"2026-09-10T03:50:40.493461444Z","published_at":"2026-03-26T18:48:55Z","references":["https://osv.dev/vulnerability/GHSA-pwqr-wmgm-9rr8","https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","https://nvd.nist.gov/vuln/detail/CVE-2026-33870","https://github.com/netty/netty","https://w4ke.info/2025/06/18/funky-chunks.html","https://w4ke.info/2025/10/29/funky-chunks-2.html","https://www.rfc-editor.org/rfc/rfc9110"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-pwqr-wmgm-9rr8","url":"https://osv.dev/vulnerability/GHSA-pwqr-wmgm-9rr8"}],"summary":"Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing"}