Medium severity · published Mar 30, 2021
CVE-2021-21409
Possible request smuggling in HTTP/2 due missing validation of content-length
5.9
CVSS
4.9%
EPSS
No
On KEV
Description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netty · netty
< 4.1.61.Final · source: vendor, NVD
BC
Banking Corporate Lending Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BC
Banking Credit Facilities Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BT
Banking Trade Finance Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
CO
Coherence · Oracle
12.2.1.4.0; 14.1.1.0.0 · source: NVD
CB
Communications Brm - Elastic Charging Engine · Oracle
12.0.0.3 · source: NVD
CC
Communications Cloud Native Core Console · Oracle
1.7.0 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.14.0 · source: NVD
CD
Communications Design Studio · Oracle
7.4.2.0.0 · source: NVD
CM
Communications Messaging Server · Oracle
8.1 · source: NVD
DL
Debian Linux · Debian
10.0 · source: NVD
HE
Helidon · Oracle
1.4.10; 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21409
Third Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295
Patch
https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432
Third Party Advisory
https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32
Third Party Advisory
https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj
lists.apache.org
https://lists.apache.org/thread.html/r0b09f3e31e004fe583f677f7afa46bd30110904576c13c5ac818ac2c%40%3Cissues.flink.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0ca82fec33334e571fe5b388272260778883e307e15415d7b1443de2%40%3Cissues.zookeeper.apache.org%3E
More from netty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.8
CVE-2026-56817
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
9.8
CVE-2026-42581
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization