Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strin…

Netty, an asynchronous event-driven network application framework, contains a vulnerability in versions prior to 4.1.132.Final and 4.2.10.Final. The framework incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, which enables request smuggling attacks. This parsing flaw can allow attackers to manipulate HTTP request processing and potentially bypass security controls. The vulnerability has been addressed in the latest versions 4.1.132.Final and 4.2.10.Final with proper parsing fixes.