Possible request smuggling in HTTP/2 due missing validation of content-length

TRUNG BÌNH 5.9CVE-2021-21409 · GHSA-f256-j965-7f32 · Công bố 30/03/2021 · cập nhật 08/10/2026

Tóm tắt nhanh

CVE-2021-21409 là lỗ hổng mức TRUNG BÌNH (CVSS 5.9) ảnh hưởng io.netty:netty, io.netty:netty-codec-http2, org.jboss.netty:netty.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 4.9%, cao hơn 92.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.1.61.Final, 4.1.61, 9.2.6.3, 21.1.12 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
io.netty:netty Maven	`mọi phiên bản`	Chưa có bản vá
io.netty:netty-codec-http2 Maven	`≥ 4.0.0, < 4.1.61.Final`	`4.1.61.Final`
org.jboss.netty:netty Maven	`mọi phiên bản`	Chưa có bản vá
netty netty	`< 4.1.61`	`4.1.61`
banking corporate lending process management oracle	`= 14.2.0= 14.3.0= 14.5.0`	Chưa có bản vá
banking credit facilities process management oracle	`= 14.2.0= 14.3.0= 14.5.0`	Chưa có bản vá
banking trade finance process management oracle	`= 14.2.0= 14.3.0= 14.5.0`	Chưa có bản vá

Mô tả

Impact

The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1

This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case.

Patches

This was fixed as part of 4.1.61.Final

Workarounds

Validation can be done by the user before proxy the request by validating the header.

Mô tả của NVD

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.