CyberRota Analysis
AI-GeneratedThe vulnerability affects the Netty framework's HTTP/2-to-HTTP/1.x translation layer, which improperly handles `Host` headers when both the `:authority` pseudo-header and a literal `host` header are present in a single HEADERS frame. This flaw allows attackers to create an `HttpRequest` object with conflicting `Host` headers, potentially leading to HTTP request smuggling or other malicious behaviors. Organizations using affected versions of Netty should prioritize upgrading to versions 4.1.136.Final or 4.2.16.Final to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Related CVEs
Other vulnerabilities affecting the same vendor(s)