CVE-2026-59900
CVE-2026-59900 · Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVSS 6.9 · Medium · EPSS 0.4%
- Published
- Updated
Stack: system
Affected products and versions
netty
- Versions
- >= 4.2.0.Final, < 4.2.16.Final: Affected
- < 4.1.136.Final: Affected
No fix published
netty Debian:12
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- 1:4.1.48-7
- 1:4.1.48-7+deb12u1
- 1:4.1.48-7+deb12u2
- 1:4.1.48-8
- 1:4.1.48-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Debian:13
- Versions
- 1:4.1.48-10
- 1:4.1.48-10+deb13u1
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Debian:14
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:14.04:LTS
- Versions
- 1:3.2.6.Final-2
- 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
- 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:16.04:LTS
- Versions
- 1:3.2.6.Final-2
- 1:4.0.32-1
- 1:4.0.33-1
- 1:4.0.34-1
- 1:4.0.34-1ubuntu0.1~esm1
- 1:4.0.34-1ubuntu0.1~esm2
- 1:4.0.34-1ubuntu0.1~esm3
- 1:4.0.34-1ubuntu0.1~esm4
- 1:4.0.34-1ubuntu0.1~esm5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:18.04:LTS
- Versions
- 1:4.1.7-4
- 1:4.1.7-4ubuntu0.1~esm1
- 1:4.1.7-4ubuntu0.1
- 1:4.1.7-4ubuntu0.1+esm1
- 1:4.1.7-4ubuntu0.1+esm2
- 1:4.1.7-4ubuntu0.1+esm3
- 1:4.1.7-4ubuntu0.1+esm4
- 1:4.1.7-4ubuntu0.1+esm5
- 1:4.1.7-4ubuntu0.1+esm6
- 1:4.1.7-4ubuntu0.1+esm7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:20.04:LTS
- Versions
- 1:4.1.33-1
- 1:4.1.33-2
- 1:4.1.33-3
- 1:4.1.45-1
- 1:4.1.45-1ubuntu0.1~esm1
- 1:4.1.45-1ubuntu0.1~esm2
- 1:4.1.45-1ubuntu0.1~esm3
- 1:4.1.45-1ubuntu0.1~esm4
- 1:4.1.45-1ubuntu0.1~esm6
- 1:4.1.45-1ubuntu0.1~esm7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:22.04:LTS
- Versions
- 1:4.1.48-4
- 1:4.1.48-4+deb11u1build0.22.04.1
- 1:4.1.48-4+deb11u2build0.22.04.1
- 1:4.1.48-4+deb11u2ubuntu0.1~esm1
- 1:4.1.48-4+deb11u2ubuntu0.1~esm2
- 1:4.1.48-4+deb11u2ubuntu0.1
- 1:4.1.48-4+deb11u2ubuntu0.1+esm1
- 1:4.1.48-4+deb11u2ubuntu0.1+esm3
- 1:4.1.48-4+deb11u2ubuntu0.2
- 1:4.1.48-4+deb11u2ubuntu0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:24.04:LTS
- Versions
- 1:4.1.48-7
- 1:4.1.48-8
- 1:4.1.48-9
- 1:4.1.48-9ubuntu0.1~esm1
- 1:4.1.48-9ubuntu0.1~esm2
- 1:4.1.48-9ubuntu0.1
- 1:4.1.48-9ubuntu0.1+esm1
- 1:4.1.48-9ubuntu0.1+esm3
- 1:4.1.48-9ubuntu0.2
- 1:4.1.48-9ubuntu0.2+esm1
- 1:4.1.48-9ubuntu0.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:26.10
- Versions
- 1:4.1.48-16
- 1:4.1.48-16ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:26.04:LTS
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-16
- 1:4.1.48-16ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published