CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

December 15, 2025 (updated December 20, 2025)

The io.netty.handler.codec.http.HttpRequestEncoder CRLF injection with the request uri when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the uri.

References

github.com/advisories/GHSA-84h7-rjj3-6jx4
github.com/netty/netty
github.com/netty/netty/commit/77e81f1e5944d98b3acf887d3aa443b252752e94
github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
nvd.nist.gov/vuln/detail/CVE-2025-67735

Code Behaviors & Features

Detect and mitigate CVE-2025-67735 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →