CVE-2021-21409 json
Possible request smuggling in HTTP/2 due missing validation of content-length
published 2021-03-30 5 y ago modified 2026-10-08 31 d ago also GHSA-f256-j965-7f32 , EUVD-2021-0647
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.9%
- EPSS 4.9% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
Patch / fix
- maven io.netty:netty-codec-http2 4.1.61.Final
- netty netty 4.1.61
- oracle jd_edwards_enterpriseone_tools 9.2.6.3
- oracle nosql_database 21.1.12
- netty Debian 14, Debian 13, Debian 12 1:4.1.48-4
debian advisories DEBIAN-CVE-2021-21409
- netty Ubuntu 22.04 LTS 1:4.1.48-4+deb11u1build0.22.04.1
- netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm1
- netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm2
- netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2021-21409
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el7sat
- foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el8sat
- libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el7pc
- libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el8pc
- candlepin satellite 6.11 4.1.13-1.el7sat
- candlepin satellite 6.11 4.1.13-1.el8sat
- satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el7sat
- satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el8sat
red hat advisories RHSA-2022:5498RHSA-2021:3658RHSA-2021:3656RHSA-2021:2694RHSA-2021:2692RHSA-2021:2693
- netty openSUSE Leap 15.3 4.1.75-150200.4.9.1
suse advisories SUSE-SU-2022:1315-1
- netty openSUSE Tumbleweed 4.1.114-1.1
opensuse advisories openSUSE-SU-2024:14442-1
- libdb Rocky Linux 8 5.3.28-42.el8_4
rocky linux advisories RLSA-2022:5498
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-21409 updated cvss 5.9
netty: Request smuggling via content-length header
-
Red Hat A-MQ Online netty nettyaffected: no fix planned “Will not fix”
-
Red Hat build of Quarkus netty nettyaffected: no fix available
-
Red Hat JBoss A-MQ 6 netty netty Red Hat JBoss Data Grid 7 netty netty Red Hat JBoss Enterprise Application Platform 5 netty netty Red Hat JBoss Enterprise Application Platform 6 netty nettyaffected: no fix planned “Out of support scope”
-
Red Hat JBoss Enterprise Application Platform Expansion Pack netty nettyaffected: no fix available
-
Red Hat JBoss Fuse 6 netty netty Red Hat JBoss Operations Network 3 netty nettyaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Application Runtimes netty netty Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5affected: no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5, openshift4/ose-logging-elasticsearch6 Red Hat OpenStack Platform 10 (Newton) opendaylightaffected: no fix planned “Out of support scope”
-
Red Hat OpenStack Platform 13 (Queens) opendaylightaffected: no fix planned “Will not fix”
show 22 moreshow fewer
-
Red Hat EAP 7.3.8fixed: vendor fix RHSA-2021:2696
-
Red Hat OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8 v6.8.1-67fixed: vendor fix RHSA-2021:5128
-
Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8 v6.8.1-66fixed: vendor fix RHSA-2021:5127
-
Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8 v6.8.1-65fixed: vendor fix RHSA-2021:5129
-
Red Hat AMQ 7.8.2fixed: vendor fix RHSA-2021:2689
-
Red Hat AMQ 7.9.0fixed: vendor fix RHSA-2021:3700
-
Red Hat AMQ Clients 2 qpid-proton 0.33.0-8.el8, qpid-proton 0.33.0-6.el7_9, qpid-proton-c 0.33.0-8.el8, qpid-proton-c 0.33.0-6.el7_9, qpid-proton-cpp 0.33.0-8.el8, qpid-proton-cpp 0.33.0-6.el7_9, +6 morefixed: vendor fix RHSA-2021:1511
-
Red Hat AMQ Streams 1.8.0fixed: vendor fix RHSA-2021:3225
-
Red Hat build of Quarkus 2.2.3fixed: vendor fix RHSA-2021:3880
-
Red Hat Data Grid 8.2.0fixed: vendor fix RHSA-2021:2139
-
Red Hat EAP-XP 2.0.0 via EAP 7.3.x basefixed: vendor fix RHSA-2021:2755
-
Red Hat Fuse 7.10fixed: vendor fix RHSA-2021:5134
-
Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wildfly 7.3.8-1.GA_redhat_00001.1.el8eap, eap7-jberet 1.3.8-1.Final_redhat_00001.1.el8eap, eap7-netty 4.1.63-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.0.38-1.SP1_redhat_00001.1.el8eap, eap7-hibernate 5.3.20-3.SP1_redhat_00001.1.el8eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el8eap, +58 morefixed: vendor fix RHSA-2021:2694
-
Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wildfly 7.3.8-1.GA_redhat_00001.1.el6eap, eap7-jberet 1.3.8-1.Final_redhat_00001.1.el6eap, eap7-netty 4.1.63-1.Final_redhat_00001.1.el6eap, eap7-undertow 2.0.38-1.SP1_redhat_00001.1.el6eap, eap7-hibernate 5.3.20-3.SP1_redhat_00001.1.el6eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el6eap, +58 morefixed: vendor fix RHSA-2021:2692
-
Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wildfly 7.3.8-1.GA_redhat_00001.1.el7eap, eap7-jberet 1.3.8-1.Final_redhat_00001.1.el7eap, eap7-netty 4.1.63-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.0.38-1.SP1_redhat_00001.1.el7eap, eap7-hibernate 5.3.20-3.SP1_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el7eap, +60 morefixed: vendor fix RHSA-2021:2693
-
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty 4.1.63-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el7eapfixed: vendor fix RHSA-2021:3656
-
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty 4.1.63-1.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.63-1.Final_redhat_00001.1.el8eapfixed: vendor fix RHSA-2021:3658
-
Red Hat JBoss Enterprise Application Platform netty-all 4.1.63.Final-redhat-00001fixed: vendor fix RHSA-2021:3660
-
Red Hat Satellite 6.11 for RHEL 7 candlepin 4.1.13-1.el7sat Red Hat Satellite 6.11 for RHEL 8 candlepin 4.1.13-1.el8satfixed: vendor fix RHSA-2022:5498
-
Red Hat Single Sign-On 7.4.8fixed: vendor fix RHSA-2021:2965
-
Red Hat Vert.x 4.1.0fixed: vendor fix RHSA-2021:2465
-
Red Hat OpenShift Logging 5.1 openshift-logging/fluentd-rhel8 v1.7.4-72, openshift-logging/kibana6-rhel8 v6.8.1-75, openshift-logging/eventrouter-rhel8 v0.3.0-65, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-68, openshift-logging/elasticsearch-rhel8-operator v5.1.5-3, openshift-logging/cluster-logging-rhel8-operator v5.1.5-3, +2 more Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-71, openshift-logging/kibana6-rhel8 v6.8.1-74, openshift-logging/eventrouter-rhel8 v0.3.0-64, openshift-logging/logging-curator5-rhel8 v5.8.1-47, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-67, openshift-logging/elasticsearch-rhel8-operator v5.2.4-4, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-70, openshift-logging/kibana6-rhel8 v6.8.1-73, openshift-logging/eventrouter-rhel8 v0.3.0-63, openshift-logging/logging-curator5-rhel8 v5.8.1-46, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-66, openshift-logging/elasticsearch-rhel8-operator v5.3.1-3, +4 more Red Hat Decision Manager 7 netty nettynot affected: vulnerable code not present
6 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 31 d ago
Exploit prediction
4.93% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.netty:netty-codec-http2 | >=4.0.0, <4.1.61.Final |
4.1.61.Final |
| maven | org.jboss.netty:netty | all versions |
no fix listed |
| maven | io.netty:netty | all versions |
no fix listed |
Affected products
- netty netty
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
github.com
/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432
web, patch, third-party-advisory
-
oracle.com
//security-alerts/cpujul2021.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuapr2022.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory
-
debian.org
/security/2021/dsa-4885
vendor-advisory, web
-
github.com
/netty/netty/security/advisories/GHSA-f256-j965-7f32
web, third-party-advisory
-
github.com
/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj
web, third-party-advisory
-
cve.mitre.org
/cgi-bin/cvename.cgi?name=CVE-2021-21295
web, third-party-advisory
-
lists.apache.org
/thread.html/r70c3a7bfa904f06a1902f4df20ee26e4f09a46b8fd3eb304dc57a2de%40%3Cdev.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/ra66e93703e3f4bd31bdfd0b6fb0c32ae96b528259bb1aa2b6d38e401%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r2732aa3884cacfecac4c54cfaa77c279ba815cad44b464a567216f83%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r0ca82fec33334e571fe5b388272260778883e307e15415d7b1443de2%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r823d4b27fcba8dad5fe945bdefce3ca5a0031187966eb6ef3cc22ba9%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r101f82d8f3b5af0bf79aecbd5b2dd3b404f6bb51d1a54c2c3d29bed9%40%3Cnotifications.zookeeper.apache.org
mailing-list
-
lists.apache.org
/thread.html/rf521ff2be2e2dd38984174d3451e6ee935c845948845c8fccd86371d%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r5cbea8614812289a9b98d0cfc54b47f54cef424ac98d5e315b791795%40%3Cnotifications.zookeeper.apache.org
mailing-list
-
lists.apache.org
/thread.html/rdd206d9dd7eb894cc089b37fe6edde2932de88d63a6d8368b44f5101%40%3Ccommits.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rac8cf45a1bab9ead5c9a860cbadd6faaeb7792203617b6ec3874736d%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r4a98827bb4a7edbd69ef862f2351391845697c40711820d10df52ca5%40%3Ccommits.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r69efd8ef003f612c43e4154e788ca3b1f837feaacd16d97854402355%40%3Ccommits.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r4b8be87acf5b9c098a2ee350b5ca5716fe7afeaf0a21a4ee45a90687%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re4b0141939370304d676fe23774d0c6fbc584b648919825402d0cb39%40%3Cnotifications.zookeeper.apache.org
mailing-list
-
lists.apache.org
/thread.html/rdd5715f3ee5e3216d5e0083a07994f67da6dbb9731ce9e7a6389b18e%40%3Ccommits.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r1b3cb056364794f919aaf26ceaf7423de64e7fdd05a914066e7d5219%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rf38e4dcdefc7c59f7ba0799a399d6d6e37b555d406a1dfc2fcbf0b35%40%3Ccommits.pulsar.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r61564d86a75403b854cdafee67fc69c8b88c5f6802c2c838f4282cc8%40%3Ccommits.pulsar.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r7879ddcb990c835c6b246654770d836f9d031dee982be836744e50ed%40%3Ccommits.pulsar.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e33324b70a06a%40%3Cissues.flink.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/ra64d56a8a331ffd7bdcd24a9aaaeeedeacd5d639f5a683389123f898%40%3Cdev.flink.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e%40%3Cissues.flink.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e68ad0324%40%3Cissues.flink.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rbde2f13daf4911504f0eaea43eee4f42555241b5f6d9d71564b6c5fa%40%3Cjira.kafka.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r855b4b6814ac829ce2d48dd9d8138d07f33387e710de798ee92c011e%40%3Cissues.flink.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rafc77f9f03031297394f3d372ccea751b23576f8a2ae9b6b053894c5%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re39391adcb863f0e9f3f15e7986255948f263f02e4700b82453e7102%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re9e6ed60941da831675de2f8f733c026757fb4fa28a7b6c9f3dfb575%40%3Cdev.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/re1911e05c08f3ec2bab85744d788773519a0afb27272a31ac2a0b4e8%40%3Cnotifications.zookeeper.apache.org
mailing-list
-
lists.apache.org
/thread.html/redef0fb5474fd686781007de9ddb852b24f1b04131a248d9a4789183%40%3Cnotifications.zookeeper.apache.org
mailing-list
-
lists.apache.org
/thread.html/r0b09f3e31e004fe583f677f7afa46bd30110904576c13c5ac818ac2c%40%3Cissues.flink.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r602e98daacc98934f097f07f2eed6eb07c18bfc1949c8489dc7bfcf5%40%3Cissues.flink.apache.org%3E
mailing-list
- security.netapp.com /advisory/ntap-20210604-0003/
-
lists.apache.org
/thread.html/rba2a9ef1d0af882ab58fadb336a58818495245dda43d32a7d7837187%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2021-21409
advisory
-
lists.apache.org
/thread.html/re39391adcb863f0e9f3f15e7986255948f263f02e4700b82453e7102@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/re1911e05c08f3ec2bab85744d788773519a0afb27272a31ac2a0b4e8@%3Cnotifications.zookeeper.apache.org%3
web
-
lists.apache.org
/thread.html/rdd5715f3ee5e3216d5e0083a07994f67da6dbb9731ce9e7a6389b18e@%3Ccommits.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rdd206d9dd7eb894cc089b37fe6edde2932de88d63a6d8368b44f5101@%3Ccommits.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E
web
-
lists.apache.org
/thread.html/rd4a6b7dec38ea6cd28b6f94bd4b312629a52b80be3786d5fb0e474bc@%3Cissues.kudu.apache.org%3E
web
-
lists.apache.org
/thread.html/rcae42fba06979934208bbd515584b241d3ad01d1bb8b063512644362@%3Cdev.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rca0978b634a0c3ebee4126ec29c7f570b165fae3f8f3658754c1cbd3@%3Cissues.kudu.apache.org%3E
web
-
lists.apache.org
/thread.html/rbde2f13daf4911504f0eaea43eee4f42555241b5f6d9d71564b6c5fa@%3Cjira.kafka.apache.org%3E
web
-
lists.apache.org
/thread.html/rba2a9ef1d0af882ab58fadb336a58818495245dda43d32a7d7837187@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rafc77f9f03031297394f3d372ccea751b23576f8a2ae9b6b053894c5@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/rac8cf45a1bab9ead5c9a860cbadd6faaeb7792203617b6ec3874736d@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/raa413040db6d2197593cc03edecfd168732e697119e6447b0a25d525@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/ra66e93703e3f4bd31bdfd0b6fb0c32ae96b528259bb1aa2b6d38e401@%3Cissues.zookeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/re4b0141939370304d676fe23774d0c6fbc584b648919825402d0cb39@%3Cnotifications.zookeeper.apache.org%3
web
-
lists.apache.org
/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e68ad0324@%3Cissues.flink.apache.org%3E
web
Sources
- CVE List CVE-2021-21409
- GitHub Advisory GHSA-f256-j965-7f32
- NVD CVE-2021-21409
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.