Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qyhp-twx4-vffc
Vulnerability ID VCID-qyhp-twx4-vffc
Aliases CVE-2025-67735
GHSA-84h7-rjj3-6jx4
Summary Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the uri.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-67735.json
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-67735
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-84h7-rjj3-6jx4
cvssv3.1 6.5 https://github.com/netty/netty
generic_textual MODERATE https://github.com/netty/netty
cvssv3.1 6.5 https://github.com/netty/netty/commit/77e81f1e5944d98b3acf887d3aa443b252752e94
generic_textual MODERATE https://github.com/netty/netty/commit/77e81f1e5944d98b3acf887d3aa443b252752e94
cvssv3.1 6.5 https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
cvssv3.1_qr MODERATE https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
generic_textual MODERATE https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
ssvc Track https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-67735
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-67735
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-67735.json
https://api.first.org/data/v1/epss?cve=CVE-2025-67735
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67735
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/netty/netty
https://github.com/netty/netty/commit/77e81f1e5944d98b3acf887d3aa443b252752e94
1123606 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123606
2422568 https://bugzilla.redhat.com/show_bug.cgi?id=2422568
CVE-2025-67735 https://nvd.nist.gov/vuln/detail/CVE-2025-67735
GHSA-84h7-rjj3-6jx4 https://github.com/advisories/GHSA-84h7-rjj3-6jx4
GHSA-84h7-rjj3-6jx4 https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
RHSA-2026:1899 https://access.redhat.com/errata/RHSA-2026:1899
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-67735.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/netty/netty
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/netty/netty/commit/77e81f1e5944d98b3acf887d3aa443b252752e94
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-16T14:26:21Z/ Found at https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-67735
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07769
EPSS Score 0.00028
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:53:32.208582+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty-codec-http/CVE-2025-67735.yml 38.0.0