CVE-2021-21409

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) in maven/io.netty/netty-codec-http2

Identifiers

CVE-2021-21409, GHSA-f256-j965-7f32, GHSA-wm47-8v5p-wjpj

Package Slug

maven/io.netty/netty-codec-http2

Vulnerability

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)

Description

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case.

Affected Versions

All versions before 4.1.61

Solution

Upgrade to version 4.1.61.Final or above.

Last Modified

2021-04-21

source