PT-2026-63548 · Maven · Io.Netty:Netty-Codec-Http2

CVE-2026-59900 · Publicado 2026-07-22 · Atualizado 2026-07-22

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Netty's HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps :authority to Host and separately copies the literal host header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values.

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2026-59900

GHSA-C69G-56F8-XWQJ

Produtos afetados

Io.Netty:Netty-Codec-Http2

Referências · 5

• https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj · Nota
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Nota
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Nota
• https://github.com/netty/netty · Nota
• https://osv.dev/vulnerability/GHSA-c69g-56f8-xwqj · Aviso do Fabricante