p PatchFirst

CVE-2021-21409

CVE-2021-21409 · Possible request smuggling in HTTP/2 due missing validation of content-length

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

CVSS 5.9 · Medium · EPSS 4.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • netty

    Versions
    • < 4.1.61.Final: Affected

    No fix published

  • netty Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-4

    Update to 1:4.1.48-4

  • netty Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-4

    Update to 1:4.1.48-4

  • netty Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-4

    Update to 1:4.1.48-4

  • netty Ubuntu:Pro:14.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
    • 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:16.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:4.0.32-1
    • 1:4.0.33-1
    • 1:4.0.34-1
    Affected ranges
    • ECOSYSTEM: < 1:4.0.34-1ubuntu0.1~esm1

    Update to 1:4.0.34-1ubuntu0.1~esm1

  • netty Ubuntu:Pro:18.04:LTS

    Versions
    • 1:4.1.7-4
    • 1:4.1.7-4ubuntu0.1~esm1
    • 1:4.1.7-4ubuntu0.1
    • 1:4.1.7-4ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.7-4ubuntu0.1+esm2

    Update to 1:4.1.7-4ubuntu0.1+esm2

  • netty Ubuntu:Pro:20.04:LTS

    Versions
    • 1:4.1.33-1
    • 1:4.1.33-2
    • 1:4.1.33-3
    • 1:4.1.45-1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.45-1ubuntu0.1~esm1

    Update to 1:4.1.45-1ubuntu0.1~esm1

  • netty Ubuntu:22.04:LTS

    Versions
    • 1:4.1.48-4
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-4+deb11u1build0.22.04.1

    Update to 1:4.1.48-4+deb11u1build0.22.04.1

Original sources

Check your server →