PT-2026-63548 · Maven · Io.Netty:Netty-Codec-Http2

CVE-2026-59900 · Published 2026-07-22 · Updated 2026-07-22

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Netty's HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps :authority to Host and separately copies the literal host header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-59900

GHSA-C69G-56F8-XWQJ

Affected Products

Io.Netty:Netty-Codec-Http2

References · 5

• https://osv.dev/vulnerability/GHSA-c69g-56f8-xwqj · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty · Note