CVE-2021-21409 Possible request smuggling in HTTP/2 due missing validation of content-length
Attackers can perform HTTP request smuggling via Netty's HTTP/2 codec when content-length validation is missing, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21409?
CVE-2021-21409 is a medium-severity vulnerability in Debian Debian Linux, published on 30 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
Weakness: CWE-444
Which versions are affected by CVE-2021-21409?
6 open source packages ship an affected version, including io.netty:netty, io.netty:netty-codec-http2 and org.jboss.netty:netty. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty Maven | All versions | None |
io.netty:netty Maven | All versions | None |
io.netty:netty-codec-http2 Maven | From 4.0.0 | 4.1.61.Final |
io.netty:netty-codec-http2 Maven | From 4.0.0 | 4.1.61.Final |
org.jboss.netty:netty Maven | All versions | None |
org.jboss.netty:netty Maven | All versions | None |
Linux distribution packages (1)
netty openSUSE:Leap 15.3 | All versions | 4.1.75-150200.4.9.1 |
Products include Debian Debian Linux, Netapp Oncommand Api Services, Netapp Oncommand Workflow Automation, Netty Netty, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management and 12 more.
How do I fix CVE-2021-21409?
Upgrade to a fixed version.
Is CVE-2021-21409 being exploited?
There is no known exploitation of CVE-2021-21409 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-WI10177, CLEANSTART-2026-ZX30626, DEBIAN-CVE-2021-21409, GHSA-f256-j965-7f32, SUSE-SU-2022:1315-1, UBUNTU-CVE-2021-21409.