Skip to main content

Netty codec-http2 CVE-2026-59900

| EUVDEUVD-2026-50442 MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2026-07-22 https://github.com/netty/netty GHSA-c69g-56f8-xwqj
Information Disclosure Request Smuggling
6.9
CVSS 4.0 · Vendor: https://github.com/netty/netty
Share

Severity by source

Vendor (https://github.com/netty/netty) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.2 HIGH

Network-accessible with no authentication; scope changes because crafted requests manipulate downstream HTTP/1.1 backends outside Netty's own security boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
7.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/netty/netty).

CVSS VectorVendor: https://github.com/netty/netty

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVSS changed
Jul 29, 2026 - 18:22 NVD
6.9 (MEDIUM)
Source Code Evidence Fetched
Jul 22, 2026 - 22:23 vuln.today
Analysis Generated
Jul 22, 2026 - 22:23 vuln.today
CVE Published
Jul 22, 2026 - 21:49 cve.org
MEDIUM

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 283 maven packages depend on io.netty:netty-codec-http2 (20 direct, 263 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionCVE.org

Netty's HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps :authority to Host and separately copies the literal host header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values.

AnalysisAI

HTTP/2-to-HTTP/1.x protocol translation in Netty's netty-codec-http2 enables request routing bypass and HTTP request smuggling via duplicate Host header injection. When a client sends a HEADERS frame containing both the :authority pseudo-header and a literal host header, Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter independently translate each into Host headers, producing an HttpRequest with two attacker-controlled, differing values. Downstream HTTP/1.1 components that prioritize the second header can be manipulated into routing requests to unintended targets. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but patches are vendor-released for both affected release trains.

Technical ContextAI

CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request Smuggling) describes this root cause class: two components in a processing chain interpret the same ambiguous request differently, enabling an attacker to desynchronize their views. In HTTP/2, RFC 9113 §8.3.1 mandates that a host header field in a request MUST be identical to the :authority pseudo-header and is technically redundant. Netty's translation layer in Http2StreamFrameToHttpObjectCodec maps :authority → Host, but neither it nor InboundHttp2ToHttpAdapter strips or deduplicates a co-present literal host header before constructing the downstream HttpRequest object. The resulting HTTP/1.1 request carries two Host headers with differing, attacker-supplied values. The affected Maven artifact is io.netty:netty-codec-http2, used in Netty-based reverse proxies, API gateways, and microservice frameworks that accept HTTP/2 inbound and translate to HTTP/1.1 backends.

RemediationAI

Upgrade io.netty:netty-codec-http2 to 4.1.136.Final for 4.1.x deployments or 4.2.16.Final for 4.2.x deployments; both are vendor-released patches confirmed by the GitHub advisory GHSA-c69g-56f8-xwqj and release pages at https://github.com/netty/netty/releases/tag/netty-4.1.136.Final and https://github.com/netty/netty/releases/tag/netty-4.2.16.Final. If immediate upgrade is not feasible, a compensating control is to deploy an upstream WAF or load balancer configured to strip or reject HTTP/1.1 requests containing duplicate Host headers before they reach backend services - note this may reject malformed-but-legitimate requests from buggy clients. A second option is to restrict HTTP/2 ingress to trusted, authenticated internal clients only, eliminating the unauthenticated attack surface at the cost of protocol flexibility for external consumers. Disabling the HTTP/2-to-HTTP/1.x translation codecs entirely and using HTTP/2 end-to-end eliminates the vulnerable code path but requires backend HTTP/2 support.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-59900 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy