Skip to content
Fencer Vulns
medium 5.9

CVE-2021-21295 json

Possible request smuggling in HTTP/2 due missing validation

published 2021-03-09 5 y ago modified 2026-10-08 31 d ago also BIT-zookeeper-2021-21295 , EUVD-2021-0719 , GHSA-wm47-8v5p-wjpj

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
18.9%
EPSS 18.9% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

Patch / fix

  • maven io.netty:netty-codec-http2 4.1.60.Final
  • bitnami zookeeper 3.5.10
  • netty netty 4.1.60
  • apache kudu 1.16.0
  • netty Debian 14, Debian 13, Debian 12 1:4.1.48-3

debian advisories DEBIAN-CVE-2021-21295

  • netty Ubuntu 22.04 LTS 1:4.1.48-4+deb11u1build0.22.04.1
  • netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm1
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm2
  • netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-21295

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el7sat
  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el8sat
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el7pc
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el8pc
  • candlepin satellite 6.11 4.1.13-1.el7sat
  • candlepin satellite 6.11 4.1.13-1.el8sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el7sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el8sat

red hat advisories RHSA-2022:5498RHSA-2021:3658RHSA-2021:3656RHSA-2021:2047RHSA-2021:2046RHSA-2021:2048

  • netty openSUSE Leap 15.3 4.1.75-150200.4.6.2

suse advisories SUSE-SU-2022:1271-1

  • netty openSUSE Tumbleweed 4.1.60-1.4
  • netty openSUSE Leap 15.2 4.1.13-lp152.3.3.1

opensuse advisories openSUSE-SU-2024:11085-1openSUSE-SU-2021:0448-1

  • libdb Rocky Linux 8 5.3.28-42.el8_4

rocky linux advisories RLSA-2022:5498

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21295 updated cvss 5.9

netty: possible request smuggling in HTTP/2 due missing validation

  • Red Hat build of Quarkus netty netty
    affected: no fix available
  • Red Hat JBoss A-MQ 6 netty netty Red Hat JBoss Data Grid 7 netty netty Red Hat JBoss Enterprise Application Platform 5 netty netty Red Hat JBoss Enterprise Application Platform 6 netty netty
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack netty netty
    affected: no fix available
  • Red Hat JBoss Fuse 6 netty netty Red Hat JBoss Operations Network 3 netty netty
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes netty netty Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5, openshift4/ose-logging-elasticsearch6 Red Hat OpenStack Platform 10 (Newton) opendaylight
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: no fix planned “Will not fix”
  • Red Hat AMQ 7.8.2
    fixed: vendor fix RHSA-2021:2689
show 18 more
  • Red Hat AMQ 7.9.0
    fixed: vendor fix RHSA-2021:3700
  • Red Hat AMQ Clients 2 qpid-proton 0.33.0-8.el8, qpid-proton 0.33.0-6.el7_9, qpid-proton-c 0.33.0-8.el8, qpid-proton-c 0.33.0-6.el7_9, qpid-proton-cpp 0.33.0-8.el8, qpid-proton-cpp 0.33.0-6.el7_9, +6 more
    fixed: vendor fix RHSA-2021:1511
  • Red Hat AMQ Online 1.7.0 GA
    fixed: vendor fix RHSA-2021:0986
  • Red Hat AMQ Streams 1.8.0
    fixed: vendor fix RHSA-2021:3225
  • Red Hat build of Eclipse Vert.x 4.0.3
    fixed: vendor fix RHSA-2021:0943
  • Red Hat build of Quarkus 2.2.3
    fixed: vendor fix RHSA-2021:3880
  • Red Hat Data Grid 8.2.0
    fixed: vendor fix RHSA-2021:2139
  • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:2755
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-yasson 1.0.9-1.redhat_00001.1.el8eap, eap7-velocity 2.3.0-1.redhat_00001.1.el8eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el8eap, eap7-wildfly 7.3.7-1.GA_redhat_00002.1.el8eap, eap7-netty 4.1.60-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle 1.68.0-2.redhat_00005.1.el8eap, +92 more
    fixed: vendor fix RHSA-2021:2048
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-yasson 1.0.9-1.redhat_00001.1.el6eap, eap7-velocity 2.3.0-1.redhat_00001.1.el6eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el6eap, eap7-wildfly 7.3.7-1.GA_redhat_00002.1.el6eap, eap7-netty 4.1.60-1.Final_redhat_00001.1.el6eap, eap7-bouncycastle 1.68.0-2.redhat_00005.1.el6eap, +92 more
    fixed: vendor fix RHSA-2021:2046
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-yasson 1.0.9-1.redhat_00001.1.el7eap, eap7-velocity 2.3.0-1.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el7eap, eap7-wildfly 7.3.7-1.GA_redhat_00002.1.el7eap, eap7-netty 4.1.60-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle 1.68.0-2.redhat_00005.1.el7eap, +94 more
    fixed: vendor fix RHSA-2021:2047
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty 4.1.63-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2021:3656
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty 4.1.63-1.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2021:3658
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2021:2051
  • Red Hat Satellite 6.11 for RHEL 7 candlepin 4.1.13-1.el7sat Red Hat Satellite 6.11 for RHEL 8 candlepin 4.1.13-1.el8sat
    fixed: vendor fix RHSA-2022:5498
  • Red Hat Single Sign-On 7.4.7
    fixed: vendor fix RHSA-2021:2070
  • Red Hat Decision Manager 7 netty netty Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-yasson 1.0.9-1.redhat_00001.1.el7eap, eap7-velocity 2.3.0-1.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el7eap, eap7-jakarta-el 3.0.3-2.redhat_00006.1.el7eap, eap7-wildfly 7.4.1-2.GA_redhat_00003.1.el7eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el7eap, +51 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-yasson 1.0.9-1.redhat_00001.1.el8eap, eap7-velocity 2.3.0-1.redhat_00001.1.el8eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el8eap, eap7-jakarta-el 3.0.3-2.redhat_00006.1.el8eap, eap7-wildfly 7.4.1-2.GA_redhat_00003.1.el8eap, eap7-jberet 1.3.9-1.Final_redhat_00001.1.el8eap, +49 more Red Hat Process Automation 7 netty netty Red Hat Satellite 6.11 for RHEL 7 tfm 7.0-1.el7sat, gofer 2.12.5-7.el7sat, katello 4.3.0-3.el7sat, libsolv 0.7.22-1.el7pc, libcomps 0.1.18-1.el7pc, libsolv0 0.6.34-4.el7sat, +637 more Red Hat Satellite 6.11 for RHEL 8 libdb 5.3.28-42.el8_4, katello 4.3.0-3.el8sat, libsolv 0.7.22-1.el8pc, libcomps 0.1.18-1.el8pc, python-idna 3.3-1.el8pc, python-pbr 5.6.0-1.el8pc, +628 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

18.89% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-codec-http2
>=4.0.0, <4.1.60.Final
4.1.60.Final
maven org.jboss.netty:netty
all versions
 no fix listed
maven io.netty:netty
all versions
 no fix listed
bitnami zookeeper
>=3.5.9, <3.5.10
3.5.10

Affected products

  • netty io.netty:netty-codec-http2

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.