CVE-2025-67735

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-677367.2The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions CVE-2025-677373.7AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for i CVE-2025-677388.5squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager CVE-2025-677393.1In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure CVE-2025-67746.3A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp o CVE-2025-677405.3In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata CVE-2025-677415.4In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute CVE-2025-677427.5In JetBrains TeamCity before 2025.11 path traversal was possible via file upload CVE-2025-677436.5Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download s CVE-2025-677449.6DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security CVE-2025-677457.5MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases,CVE-2025-677464.3Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that