Bug 2536966 (CVE-2026-93574)

HTTP request smuggling via post-digit whitespace in chunk-size parsing

A public GitHub Security Advisory (GHSA-j4mg-hqgv-34qc) describes the following issue:

## Summary

`io.netty:netty-codec-http` accepts post-digit whitespace inside an HTTP/1.1 chunk-size token, truncates parsing at that whitespace/control byte, and does not validate the remaining bytes on the line. A malformed chunk line such as `5 c\r\n` is parsed as size `0x5` instead of being rejected. The attached local PoV shows Netty then parsing `GET /smuggled` as a second request on the same connection.

## PoC

Run:

```sh
bash poc/reproduce.sh
```

The important case is:

```text
POST / HTTP/1.1\r\n
Host: example\r\n
Transfer-Encoding: chunked\r\n
\r\n
5 c\r\n
GPOST\r\n
0\r\n
\r\n
GET /smuggled HTTP/1.1\r\n
Host: example\r\n
\r\n
```

Expected output:

```text
CASE internal-space-smuggle-shape
httpContent class=DefaultHttpContent bytes=5 text=GPOST decoderSuccess=true
lastContent=true
httpRequest uri=/smuggled path=/smuggled decoderSuccess=true
```

The PoV also includes:

- `5 x`, showing that arbitrary suffix bytes after post-digit whitespace are ignored for sizing.
- `5 c;foo=bar`, showing that the ambiguity survives when chunk-extension validation is invoked.

## Impact

This is an HTTP request-smuggling primitive in proxy/backend deployments where another HTTP component interprets the same malformed chunk-size line differently. Netty is the component that accepts the malformed chunked body and splits the stream into two requests.

No live services were probed. The PoV uses only `EmbeddedChannel` and `HttpRequestDecoder`.

This report is not about leading/trailing whitespace compatibility around a chunk-size line. It targets post-digit internal whitespace followed by additional token bytes.

## Suggested Fix

Reject internal whitespace/control characters in the `chunk-size` token. If Netty wants to preserve compatibility for leading/trailing SP/HTAB, the parser should transition to a trailing-whitespace state after the first post-digit whitespace byte and reject any later hex digit or token byte before `;`/CRLF.

## Affected Package/Versions

Verified affected:

- `4.2.15.Final`
- `4.2.14.Final`
- `4.2.13.Final`
- `4.1.135.Final`
- `4.1.133.Final`
- `4.1.90.Final`
- `4.1.87.Final`
- current `4.2` branch at `7bae566a93e69409697fe57fa807910ba5c9720e`

Verified not affected by this exact PoV:

- `4.1.89.Final`
- `4.1.88.Final`

## References

- Netty security policy: `https://github.com/netty/netty/security/policy`
- RFC 9112 chunked transfer coding: `https://www.rfc-editor.org/rfc/rfc9112#name-chunked-transfer-coding`
- Netty `HttpDecoderConfig` framing-validation documentation: `https://netty.io/4.2/api/io/netty/handler/codec/http/HttpDecoderConfig.html`
- Adjacent Netty chunk-size advisory: `https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723`
- Adjacent Netty initial-control-character advisory: `https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c`
- Adjacent Netty start-line injection advisory: `https://github.com/advisories/GHSA-v8h7-rr48-vmmv`
- CWE-444: `https://cwe.mitre.org/data/definitions/444.html`

## Classification

- CWE-444
- Suggested severity: Moderate
- Suggested CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L`

## Non-Duplicate Boundary

This is distinct from prior Netty request-smuggling advisories:

- `GHSA-m4cv-j2px-7723` fixed chunk-size integer overflow in `getChunkSize`; this candidate reproduces on its patched versions `4.2.13.Final` and `4.1.133.Final`.
- `GHSA-hvcg-qmg6-jm4c` / `CVE-2026-50020` fixed non-CRLF control-character skipping before the request line; this candidate is in chunk-size parsing after a normal `POST` request has already started, and it reproduces on that advisory's patched versions `4.2.15.Final` and `4.1.135.Final`.
- `GHSA-v8h7-rr48-vmmv` / `CVE-2026-41417` fixed `setUri()` start-line injection during outbound encoding; this candidate is inbound chunk-size parsing and does not require `DefaultHttpRequest.setUri()`.
- `GHSA-fghv-69vj-qj49` and `GHSA-pwqr-wmgm-9rr8` concern chunk-extension parsing; this candidate is in the chunk-size token before extension parsing.
- `GHSA-38f8-5428-x5cv` concerns malformed `Transfer-Encoding`; this candidate uses a normal `Transfer-Encoding: chunked` header and a malformed chunk-size line.

Affected:
- maven:io.netty:netty-codec-http affected >=4.2.13.Final, <=4.2.17.Final; fixed unknown
- maven:io.netty:netty-codec-http affected >=4.1.90.Final, <=4.1.137.Final; fixed unknown

Fixed versions: see advisory

Advisory: https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc