HTTP request smuggling in netty
Impact
Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.
Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.netty:netty | all versions | no fix |
| Java / Kotlin (Maven) | io.netty:netty-codec-http | >= 4.0.0, < 4.1.71.Final | 4.1.71.Final |
| Java / Kotlin (Maven) | org.jboss.netty:netty | all versions | no fix |
References
- https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
- https://nvd.nist.gov/vuln/detail/CVE-2021-43797
- https://github.com/netty/netty/pull/11891
- https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
- https://github.com/netty/netty
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20220107-0003
- https://www.debian.org/security/2023/dsa-5316
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-444- Platform
- Java / Kotlin (Maven)
- Package
io.netty:netty, io.netty:netty-codec-http, org.jboss.netty:netty- Disclosed
- 09.12.2021
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-wx5j-54mm-rqqq - CC BY 4.0
Vulnerability history: io.netty:netty
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 10.2019 05.2022
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 4
- Medium 6
Disclosures per year
- 2019: 1
- 2020: 3
- 2021: 6
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
HTTP request smuggling in netty this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.