CVE-2026-65370

The 7.5 CVSS on this CVE doesn't reflect the real threat landscape for ServiceTalk deployments. Request smuggling vulnerabilities in async HTTP pipelines have a blast radius that follows connection pool topology, and the typical deployment pattern for ServiceTalk — behind nginx, Envoy, or another reverse proxy — is where the actual exploitability lives. The vulnerability isn't primarily about someone sending a malformed request directly to ServiceTalk; it's about an upstream proxy forwarding Transfer-Encoding in a way ServiceTalk misparses, causing desynchronization that lets a second request slide past the proxy's awareness. In typical microservice meshes, that desync isn't a rare edge case — it's the default outcome of a successful exploit, enabling authentication bypass and session hijacking without needing RCE-level primitives. The Netty lineage matters here because ServiceTalk inherits its HTTP/1.1 parsing from Netty's HttpObjectDecoder, which has seen multiple Transfer-Encoding edge case fixes over the past several years. That means the specific malformation pattern triggering this CVE matters less than the structural reality: the parsing ambiguity exists in the shared dependency chain, and upgrading ServiceTalk without checking the pinned Netty version may leave the underlying vulnerability partially unaddressed. Check which Netty version your ServiceTalk dependency transitively pulls — if it's older than the recent security-patched releases, upgrading Netty independently of ServiceTalk could be necessary. Defenders should treat this as a configuration problem, not just a code patch. Hardening upstream proxies to reject ambiguous Transfer-Encoding headers before they reach ServiceTalk closes the vector even on unpatched instances. Specifically, configure your proxy to reject requests with both Transfer-Encoding and Content-Length present, and to normalize Transfer-Encoding casing. The patch in ServiceTalk 0.42.65 is necessary but not sufficient if your proxy topology creates the divergent interpretation window that triggers the desync. Monitor connection pool behavior for intermittent parsing failures under concurrent load — because this is an async pipeline, the bug can surface as transient errors that never get connected to this CVE, creating ghost exploitation conditions months after the patch is available.

Reviewed through automated stages and approved by a human before publication.