netty
diff --git a/‎codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java‎
Lines changed: 23 additions & 2 deletions b/‎codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java‎
Lines changed: 23 additions & 2 deletions
diff --git a/‎codec-http/src/test/java/io/netty/handler/codec/http/HttpRequestDecoderTest.java‎
Lines changed: 10 additions & 0 deletions b/‎codec-http/src/test/java/io/netty/handler/codec/http/HttpRequestDecoderTest.java‎
Lines changed: 10 additions & 0 deletions
@@ -29,6 +29,7 @@
 import io.netty.util.internal.SystemPropertyUtil;
 import io.netty.util.internal.ThrowableUtil;
 
+import java.util.Iterator;
 import java.util.List;
 import java.util.concurrent.atomic.AtomicBoolean;
 
@@ -846,8 +847,28 @@ private State readHeaders(ByteBuf buffer) {
         }
         if (HttpUtil.isTransferEncodingChunked(message)) {
             this.chunked = true;
-            if (!contentLengthFields.isEmpty() && message.protocolVersion() == HttpVersion.HTTP_1_1) {
-                handleTransferEncodingChunkedWithContentLength(message);
+            if (message.protocolVersion() == HttpVersion.HTTP_1_1) {
+                Iterator<? extends CharSequence> encodingIt =
+                        message.headers().valueCharSequenceIterator(HttpHeaderNames.TRANSFER_ENCODING);
+                // Validate that chunked is the last encoding.
+                // See https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length
+                CharSequence v = null;
+                while (encodingIt.hasNext()) {
+                    v = encodingIt.next();
+                }
+                final int vLen = v.length();
+                final int chunkedValueLength = HttpHeaderValues.CHUNKED.length();
+                // We only need to validate if we have more then the chunked value length contained as otherwise
+                // we know it is only chunked.
+                if (vLen > chunkedValueLength && !AsciiString.regionMatches(v, true, vLen - chunkedValueLength,
+                        HttpHeaderValues.CHUNKED,0, chunkedValueLength)) {
+                        throw new IllegalArgumentException(
+                                "chunked must be the last encoding present in the Transfer-Encoding header");
+
+                }
+                if (!contentLengthFields.isEmpty()) {
+                    handleTransferEncodingChunkedWithContentLength(message);
+                }
             }
             return State.READ_CHUNK_SIZE;
         }
 
@@ -677,6 +677,16 @@ public void testMultipleContentLengthHeadersWithFolding() {
         testInvalidHeaders0(requestStr);
     }
 
+    @Test
+    public void testChunkedNotLastInTransferEncoding() {
+        String requestStr = "GET /some/path HTTP/1.1\r\n" +
+                "Transfer-Encoding: chunked, identity\r\n" +
+                "Content-Length: 1\r\n" +
+                "Host: netty.io\r\n\r\n" +
+                "a";
+        testInvalidHeaders0(requestStr);
+    }
+
     @Test
     public void testContentLengthAndTransferEncodingHeadersWithVerticalTab() {
         testContentLengthAndTransferEncodingHeadersWithInvalidSeparator((char) 0x0b, false);