Executive brief
Netty, a widely-used Java networking library, contains a flaw in its HTTP/2 codec that mishandles protocol conversion. When translating HTTP/1 CONNECT requests to HTTP/2, the component incorrectly prioritizes the Host header over the proper CONNECT authority-form, allowing attackers to bypass tunnel security policies and egress controls. This can enable unauthorized network tunneling and integrity compromise.
Technical details
The vulnerability exists in Netty's HTTP/2 codec component when converting HTTP/1 CONNECT requests to HTTP/2 format. The flaw stems from incorrect handling of the request authority: the codec uses the Host header instead of the CONNECT authority-form request-target to populate the tunnel authority in the HTTP/2 CONNECT request. A remote attacker can supply a malicious Host header that differs from the actual CONNECT target, resulting in a malformed HTTP/2 CONNECT request that bypasses tunnel allow-lists or egress policies. No authentication is required; the attack is triggered via network-accessible HTTP/1 to HTTP/2 upgrade paths. The integrity loss allows attackers to establish unauthorized tunnels that security controls would otherwise reject.
Affected products
- Netty Project Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed