Bug 2507467 (CVE-2026-59921)

Summary:	CVE-2026-59921 io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abrianik, anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, chfoley, cmah, dandread, dbruscin, dhanak, dkreling, dlofthou, drichtar, drosa, dsimansk, eaguilar, ebaron, ehelms, ehugonne, ewittman, fmariani, fmongiar, ggainey, ggrzybek, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jmatsuok, jnethert, jpasqual, jpechane, jraez, jtolenti, juwatts, jwon, kaycoth, kgaikwad, kingland, kvanderr, lthon, manderse, mcarlett, mdellweg, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, pantinor, parichar, pberan, pcreech, pesilva, pgallagh, pjindal, pmackay, prichard, probinso, rchan, rgodfrey, rguimara, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, smallamp, ssilvert, sthirugn, sthorger, swoodman, tasato, tcunning, thjenkin, tmalecek, tqvarnst, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any validation or sanitization of CRLF (\r\n) characters. Since MIME headers are delimited by CRLF sequences, an attacker who controls the filename in a multipart upload can inject arbitrary MIME headers into the request body. This may lead to limited Content-Type spoofing or header manipulation against middleware or storage layers processing the request, though the practical impact is constrained by the context in which Netty is deployed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 13:55:35 UTC

CRLF Injection vulnerability in the multipart message encoder of the Netty Java networking library (io.netty.handler.codec.http.multipart.HttpPostRequestEncoder). The flaw is caused by the direct concatenation of user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF sequences (\r\n) in the setFilename() method of DiskFileUpload, MemoryFileUpload, and MixedFileUpload, as well as in multiple code paths within HttpPostRequestEncoder.java (lines 519, 633, 674, 682, 686–688). When a specially crafted filename containing CRLF characters is processed, an attacker can inject arbitrary MIME headers into the multipart body part, enabling Content-Type spoofing, stored cross-site scripting (XSS), form field override, or manipulation of downstream middleware and storage layers. This can be exploited remotely with low privileges and without any user interaction, allowing attackers to compromise the confidentiality and integrity of applications or services using Netty's HTTP multipart encoding.