CVE-2021-43797 HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Netty fails to validate control characters in HTTP header names, allowing HTTP request smuggling when used as a proxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-43797?
CVE-2021-43797 is a medium-severity vulnerability in Debian Debian Linux, published on 9 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Weakness: CWE-444
Which versions are affected by CVE-2021-43797?
6 open source packages ship an affected version, including io.netty:netty, io.netty:netty-codec-http and org.jboss.netty:netty. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty Maven | All versions | None |
io.netty:netty Maven | All versions | None |
io.netty:netty-codec-http Maven | From 4.0.0 | 4.1.71.Final |
io.netty:netty-codec-http Maven | From 4.0.0 | 4.1.71.Final |
org.jboss.netty:netty Maven | All versions | None |
org.jboss.netty:netty Maven | All versions | None |
Linux distribution packages (6)
netty3 SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 3.10.6-150200.3.3.2 |
netty3 SUSE:Linux Enterprise Module for Development Tools 15 SP4 | All versions | 3.10.6-150200.3.3.2 |
netty3 openSUSE:Leap 15.3 | All versions | 3.10.6-150200.3.3.2 |
netty3 openSUSE:Leap 15.4 | All versions | 3.10.6-150200.3.3.2 |
netty openSUSE:Tumbleweed | All versions | 4.1.72-1.1 |
netty3 openSUSE:Tumbleweed | All versions | 3.10.6-9.1 |
Products include Debian Debian Linux, Netapp Oncommand Workflow Automation, Netapp Snapcenter, Netty Netty, Oracle Banking Deposits and Lines of Credit Servicing, Oracle Banking Party Management and 12 more.
How do I fix CVE-2021-43797?
Upgrade to a fixed version.
Is CVE-2021-43797 being exploited?
There is no known exploitation of CVE-2021-43797 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-HO82916, CLEANSTART-2026-OX13764, CLSA-2026-1793139574, DEBIAN-CVE-2021-43797, GHSA-wx5j-54mm-rqqq, OESA-2021-1472 and 5 more.