CVE-2026-41417 — Netty allows request-line validation to be bypassed when a

title: HTTP Request Smuggling via Netty setUri() Bypass - CVE-2026-41417
id: scw-2026-05-06-ai-1
status: experimental
level: critical
description: |
  This rule detects potential HTTP request smuggling attempts targeting Netty versions vulnerable to CVE-2026-41417. The vulnerability allows bypassing request-line validation when the URI is modified after object creation. The presence of CRLF ('\r\n') within the URI, especially with a POST method, indicates an attempt to inject additional requests or manipulate the request stream, leading to desynchronization or smuggling.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41417/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '\r
  '
      cs-method|exact:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse