Netty codec-http2 CVE-2026-59900

Exploitation requires the target to use Netty's Http2StreamFrameToHttpObjectCodec or InboundHttp2ToHttpAdapter for HTTP/2-to-HTTP/1.x protocol translation - this is a specific deployment pattern, not Netty's default mode. The attacker must be able to send arbitrary HTTP/2 HEADERS frames directly to the affected Netty endpoint (network-level access over TLS or plaintext HTTP/2). Full exploitation further requires a downstream HTTP/1.1 component that interprets duplicate Host headers in an attacker-favorable way (e.g., uses the last value for routing or cache key selection). Limiting factors: deployments using HTTP/2 end-to-end without translation are unaffected; downstream components that reject or deduplicate duplicate Host headers block the routing-bypass outcome; and environments where HTTP/2 access is restricted to authenticated internal clients significantly reduce attack surface. Authentication requirements are not confirmed from available CVSS data.

No CVSS vector or score was supplied for this CVE, so all metric assessments are independently derived from the description and CWE classification. The vulnerability is network-accessible, requires no authentication (the attack is a crafted client HEADERS frame), and has low attack complexity - an attacker needs only to send a standard HTTP/2 HEADERS frame with both :authority and host populated. The scope change is material: the vulnerable Netty translator affects downstream HTTP/1.1 backends outside its own security scope, which elevates realistic impact. No EPSS data was provided and the CVE is absent from the CISA KEV catalog. No public POC has been identified at time of analysis. Real-world risk is bounded by deployment topology: only environments where Netty performs HTTP/2→HTTP/1.x translation and where downstream components resolve duplicate Host headers in favor of the second value are fully exploitable. Pure HTTP/2 end-to-end pipelines are unaffected. The availability of vendor patches for both 4.1.x and 4.2.x reduces urgency for patched environments.

An external attacker sends a crafted HTTP/2 HEADERS frame to a Netty-based reverse proxy containing :authority: legitimate.example.com and a separate host: internal-service.corp literal header. Netty's translation layer produces an HTTP/1.1 request with both Host: legitimate.example.com and Host: internal-service.corp. A downstream load balancer that selects the last Host header for routing forwards the request to internal-service.corp, bypassing access controls and potentially exposing internal services or poisoning shared caches. No public POC has been identified at time of analysis.