GitHub Advisoryadvisory · Maven

GHSA-f256-j965-7f32 Possible request smuggling in HTTP/2 due missing validation of content-length

MEDIUM Published 2021-03-30 Modified 2022-02-08 Official page ↗
Aliases
CVE-2021-21409
Ecosystem
Maven
Packages
io.netty:netty-codec-http2, org.jboss.netty:netty, io.netty:netty
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-444
Reviewed
2021-03-30

Affected packages

• Maven io.netty:netty-codec-http2: >= 4.0.0, < 4.1.61.Final → fixed in 4.1.61.Final • Maven org.jboss.netty:netty: < 4.0.0 (no fix yet) • Maven io.netty:netty: < 4.0.0 (no fix yet)

Description

Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1 This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case. Patches This was fixed as part of 4.1.61.Final Workarounds Validation can be done by the user before proxy the request by validating the header.

Related

Alias · CVE (1)

  • CVE-2021-21409 Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References