CVEvulnerability

CVE-2021-21409

5.9 MEDIUM Published 2021-03-30 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2021-03-30
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-444

Description

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

Affected configurations

• netty netty (< 4.1.61) • debian debian linux 10.0 • netapp oncommand api services • netapp oncommand workflow automation • oracle banking corporate lending process management 14.2.0 • oracle banking corporate lending process management 14.3.0 • oracle banking corporate lending process management 14.5.0 • oracle banking credit facilities process management 14.2.0 • oracle banking credit facilities process management 14.3.0 • oracle banking credit facilities process management 14.5.0 • oracle banking trade finance process management 14.2.0 • oracle banking trade finance process management 14.3.0 • oracle banking trade finance process management 14.5.0 • oracle coherence 12.2.1.4.0 • oracle coherence 14.1.1.0.0 • oracle communications brm - elastic charging engine 12.0.0.3 • oracle communications cloud native core console 1.7.0 • oracle communications cloud native core policy 1.14.0 • oracle communications design studio 7.4.2.0.0 • oracle communications messaging server 8.1 • oracle helidon 1.4.10 • oracle helidon 2.4.0 • oracle jd edwards enterpriseone tools (< 9.2.6.3) • oracle nosql database (< 21.1.12) • oracle primavera gateway (>= 17.12.0 <= 17.12.11) • oracle primavera gateway (>= 18.8.0 <= 18.8.11) • oracle primavera gateway (>= 19.12.0 <= 19.12.10) • quarkus quarkus (<= 1.13.7)

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References