Skip to content
Fencer Vulns
medium 6.5

CVE-2021-43797 json

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

published 2021-12-09 4 y ago modified 2026-10-08 31 d ago also GHSA-wx5j-54mm-rqqq , EUVD-2021-2607

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

Patch / fix

  • maven io.netty:netty-codec-http 4.1.71.Final
  • netty netty 4.1.71
  • quarkus quarkus 2.5.3
  • netty Debian 14, Debian 13, Debian 12 1:4.1.48-6

debian advisories DEBIAN-CVE-2021-43797

  • netty Ubuntu 22.04 LTS 1:4.1.48-4+deb11u1build0.22.04.1
  • netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm1
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm2
  • netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-43797

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.5-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.17-2.SP4_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-xerces-j2 jboss enterprise application platform 7.4 2.12.0-3.SP04_redhat_00001.1.el7eap
  • eap7-h2database jboss enterprise application platform 7.4 1.4.197-2.redhat_00004.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.12-1.Final_redhat_00001.1.el7eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2022:4918RHSA-2022:4919RHSA-2022:7411RHSA-2022:7409RHSA-2022:7410RHSA-2022:6783

  • netty3 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 3.10.6-150200.3.3.2
  • netty openSUSE Leap 15.3 4.1.75-150200.4.6.2

suse advisories SUSE-SU-2022:2047-1SUSE-SU-2022:1271-1

  • netty openSUSE Tumbleweed 4.1.72-1.1
  • netty3 openSUSE Tumbleweed 3.10.6-9.1

opensuse advisories openSUSE-SU-2024:11743-1openSUSE-SU-2024:11981-1

  • libdb Rocky Linux 8 5.3.28-42.el8_4

rocky linux advisories RLSA-2022:5498

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-43797 updated cvss 6.5

netty: control chars in header names may lead to HTTP request smuggling

  • Red Hat A-MQ Clients 2 netty netty
    affected: no fix available
  • Red Hat JBoss A-MQ 6 netty netty Red Hat JBoss Data Grid 7 netty netty Red Hat JBoss Enterprise Application Platform 5 netty netty Red Hat JBoss Enterprise Application Platform 6 netty netty Red Hat JBoss Fuse 6 netty netty Red Hat JBoss Operations Network 3 netty netty
    +4 more products
    Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch6 Red Hat OpenStack Platform 10 (Newton) opendaylight Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8 v6.8.1-157
    fixed: vendor fix RHSA-2022:2218
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8 v6.8.1-159
    fixed: vendor fix RHSA-2022:2217
  • Red Hat AMQ 7.10.0
    fixed: vendor fix RHSA-2022:5101
  • Red Hat AMQ Streams 2.1.0
    fixed: vendor fix RHSA-2022:1345
  • Red Hat build of Quarkus 2.7.5
    fixed: vendor fix RHSA-2022:4623
  • Red Hat Data Grid 8.3.0
    fixed: vendor fix RHSA-2022:0520
show 15 more
  • Red Hat Fuse 7.11
    fixed: vendor fix RHSA-2022:5532
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-netty-codec 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-netty-buffer 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-netty-common 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-netty-handler 4.1.72-4.Final_redhat_00001.1.el7eap, +22 more
    fixed: vendor fix RHSA-2022:4918
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-netty-codec 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-netty-buffer 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-netty-common 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-netty-handler 4.1.72-4.Final_redhat_00001.1.el8eap, +22 more
    fixed: vendor fix RHSA-2022:4919
  • Red Hat JBoss Enterprise Application Platform netty-codec-http 4.1.72.Final-redhat-00001
    fixed: vendor fix RHSA-2022:4922
  • Red Hat Satellite 6.11 for RHEL 7 candlepin 4.1.13-1.el7sat Red Hat Satellite 6.11 for RHEL 8 candlepin 4.1.13-1.el8sat
    fixed: vendor fix RHSA-2022:5498
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2022:6787
  • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:6782
  • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:6783
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:7409
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:7410
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7 1-5.el9sso, rh-sso7-runtime 1-5.el9sso, rh-sso7-javapackages-tools 6.0.0-7.el9sso, rh-sso7-python3-javapackages 6.0.0-7.el9sso, rh-sso7-javapackages-filesystem 6.0.0-7.el9sso, rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el9sso, +1 more
    fixed: vendor fix RHSA-2022:7411
  • Red Hat Single Sign-On 7.6.1
    fixed: vendor fix RHSA-2022:7417
  • Red Hat RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch6-rhel8 v6.8.1-156
    fixed: vendor fix RHSA-2022:2216
  • Red Hat RHPAM 7.13.0 async
    fixed: vendor fix RHSA-2022:5903
  • Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-176, openshift-logging/kibana6-rhel8 v6.8.1-188, openshift-logging/eventrouter-rhel8 v0.3.0-161, openshift-logging/logging-curator5-rhel8 v5.8.1-124, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-168, openshift-logging/elasticsearch-rhel8-operator v5.2.10-5, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-178, openshift-logging/kibana6-rhel8 v6.8.1-190, openshift-logging/eventrouter-rhel8 v0.3.0-164, openshift-logging/logging-curator5-rhel8 v5.8.1-126, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-171, openshift-logging/elasticsearch-rhel8-operator v5.3.7-5, +4 more Red Hat A-MQ Online netty netty Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-2.redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el7eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el7eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-h2database 1.4.197-2.redhat_00004.1.el7eap, eap7-jackson-core 2.12.6-1.redhat_00001.1.el7eap, +57 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-2.redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el8eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el8eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el8eap, eap7-h2database 1.4.197-2.redhat_00004.1.el8eap, eap7-jackson-core 2.12.6-1.redhat_00001.1.el8eap, +55 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1482 more
    +2 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack netty netty Red Hat OpenShift Application Runtimes netty netty
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
31 d ago

Exploit prediction

2.88% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-codec-http
>=4.0.0, <4.1.71.Final
4.1.71.Final
maven org.jboss.netty:netty
all versions
 no fix listed
maven io.netty:netty
all versions
 no fix listed

Affected products

  • netty netty

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.