Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unfUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hashieUpgrade rubygem-mime-typesUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-amazing_printUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-amazing_printUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-highlineUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-mime-types-dataUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-clampUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-multi_jsonUpgrade satellite-cloneUpgrade rubygem-rest-clientUpgrade tfm-runtimeUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-fast_gettextUpgrade satellite-maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-netrcUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-domain_nameUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-rest-clientUpgrade rubygem-little-plugger | Jul 14, 2022 | Mar 30, 2021 |
| Debian | — | Upgrade netty | Apr 7, 2021 | Mar 30, 2021 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 30, 2021 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 30, 2021 |
| Redhat_linux | — | Upgrade rubygem-domain_nameUpgrade tfm-runtimeUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-netrcUpgrade rubygem-fast_gettextUpgrade rubygem-localeUpgrade rubygem-powerbarUpgrade tfm-rubygem-unicodeUpgrade rubygem-amazing_printUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade foreman-cliUpgrade rubygem-hammer_cliUpgrade rubygem-http-cookieUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unf_extUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-clampUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade satellite-maintainUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-rest-clientUpgrade rubygem-netrcUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-oauthUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-localeUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-domain_nameUpgrade rubygem-unicodeUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-jwt | Jul 14, 2022 | Mar 30, 2021 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfo | Mar 12, 2024 | Mar 30, 2021 |
| Suse | — | Upgrade nettyUpgrade netty-javadocUpgrade netty-poms | Oct 26, 2022 | Mar 30, 2021 |
| Ubuntu | — | Upgrade libnetty-javaUpgrade libnetty-java (Ubuntu Pro) | May 1, 2023 | Mar 30, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 30, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub