Medium 5.9Published Mar 9, 2021

CVE-2021-21295Possible request smuggling in HTTP/2 due missing validation

Updated under an hour ago (Oct 28, 2026, 5:40 AM ET)

Does this affect you?

It affects netty io.netty:netty-codec-http2 and 8 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for netty io.netty:netty-codec-http2

Exploited in the last 30 days

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

CVSS: 5.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE): CWE-444
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

netty io.netty:netty-codec-http2 netty:io.netty_netty_codec_http2 (from the name)	before 4.1.60.Final	CNA record
netty netty netty:netty	before 4.1.60	NVD
netapp oncommand_api_services netapp:oncommand_api_services	all versions	NVD
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation	all versions	NVD
debian debian_linux debian:debian_linux	10.0	NVD
quarkus quarkus quarkus:quarkus	through 1.13.7	NVD
apache kudu apache:kudu	before 1.16.0	NVD
apache zookeeper apache:zookeeper	3.5.9	NVD
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy	1.14.0	NVD

References

References

https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj	x-refsource-confirm
https://github.com/Netflix/zuul/pull/980	x-refsource-misc
https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4	x-refsource-misc
https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f%40%3Cdev.ranger.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5%40%3Cdev.ranger.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d%40%3Ccommits.pulsar.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48%40%3Ccommits.pulsar.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325%40%3Ccommits.pulsar.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890%40%3Cissues.bookkeeper.apache.org%3E	mailing-list, x-refsource-mlist
https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904%40%3Cdev.zookeeper.apache.org%3E	mailing-list, x-refsource-mlist
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.