Executive brief
Netty, a widely used networking framework for Java applications, contains a flaw in how it handles web traffic when converting between different versions of the HTTP protocol. An attacker can send a specially crafted request that contains conflicting 'Host' information, which may confuse security filters or load balancers. This can lead to request smuggling or routing bypasses, potentially allowing unauthorized access to internal web services.
Technical details
A vulnerability exists in Netty's HTTP/2-to-HTTP/1.x translation components, specifically `Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`. When an HTTP/2 HEADERS frame contains both an `:authority` pseudo-header and a literal `host` header, the translator fails to validate or deduplicate them. This results in an `HttpRequest` object with two `Host` headers containing different, attacker-controlled values. This inconsistency can be exploited for HTTP request smuggling or to bypass security constraints in downstream proxies that rely on the `Host` header for routing or authorization. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-codec-http2 < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final
Timeline
- 2026-07-07: patched: Release of 4.2.16.Final
- 2026-07-08: patched: Release of 4.1.136.Final
- 2026-07-14: advisory: GitHub Security Advisory GHSA-c69g-56f8-xwqj published
- 2026-07-29: disclosed: CVE-2026-59900 published to NVD