Executive brief
Possible request smuggling in HTTP/2 due missing validation
Affected products
- Maven io.netty:netty-codec-http2
- Maven io.netty:netty
- Maven org.jboss.netty:netty
Junglewise Threat Intelligence
CVE-2021-21295: Possible request smuggling in HTTP/2 due missing validation
CVE-2021-21295 · Severity: low · CVSS 3.1 · Published 2021-03-09
Technologies: io.netty:netty-codec-http2 (Maven), io.netty:netty (Maven), org.jboss.netty:netty (Maven). Vendors: Maven.
Related threats
- io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
- HTTP request smuggling in netty
- SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
- Bzip2Decoder doesn't allow setting size restrictions for decompressed data
- Possible request smuggling in HTTP/2 due missing validation of content-length