CVE-2021-21409, GHSA-f256-j965-7f32, GHSA-wm47-8v5p-wjpj
maven/io.netty/netty-codec-http2
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case.
All versions before 4.1.61
Upgrade to version 4.1.61.Final or above.
2021-04-21
source |