HTTP request smuggling via malformed Transfer-Encoding validation

HTTP request smuggling in Netty's HTTP/1 decoder in Red Hat products allows remote attackers to inject requests via malformed headers. HttpObjectDecoder.readHeaders tests whether the final raw Transfer-Encoding value ends with "chunked" instead of parsing the final coding token, so split fields and values such as "xchunked" pass validation. Exploitation requires affected decoding behind an intermediary that interprets the malformed headers differently, enabling security-control bypass or unauthorized resource access.