Executive brief
Netty, a popular Java networking library used to build web servers, proxies, and gateways, contains a flaw in how it converts HTTP/1 requests to HTTP/2. An attacker can craft a malicious HTTP/1 request that bypasses security controls, potentially leading to unauthorized access to backend systems, cache poisoning attacks, or request misrouting. This vulnerability requires no authentication and can be exploited remotely.
Technical details
The vulnerability exists in Netty's HTTP/1 to HTTP/2 protocol conversion logic. When an HTTP/1 request contains both an absolute-form request-target (e.g., in the request line) and a conflicting Host header, Netty incorrectly prioritizes the Host header when constructing the HTTP/2 :authority pseudo-header, discarding the authority from the original request-target. This inconsistency allows attackers to craft requests that bypass host-based security controls in Netty-based proxies or gateways. The flaw is remotely exploitable without authentication. No patch availability information is provided in the advisory.
Affected products
- Netty Netty
Timeline
- 2026-09-18: disclosed