Read the docs
TI-2021-04507 Aliases CVE-2021-21409GHSA-f256-j965-7f32

Possible request smuggling in HTTP/2 due missing validation of content-length

Priority MEDIUM 40CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 22 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04935 92nd percentileScored 2026-11-07
Fix Partial netty (netty): 4.1.61.Finalio.netty:netty-codec-http2 (Maven): 4.1.61.FinalRed Hat: 21 advisoriesRed Hat: 22 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.61.Final4.1.61.FinalPatch availableCNA
—io.netty:netty-codec-http2 (Maven)4.0.0 to before 4.1.61.Final4.1.61.FinalPatch availableGHSA-f256-j965-7f32
—org.jboss.netty:netty (Maven)all versions—No fix listedGHSA-f256-j965-7f32
—io.netty:netty (Maven)all versions—No fix listedGHSA-f256-j965-7f32
  • netty Vendornetty Affected before 4.1.61.Final Fixed in 4.1.61.Final Patch available CNA
  • io.netty:netty-codec-http2 (Maven) Vendor— Affected 4.0.0 to before 4.1.61.Final Fixed in 4.1.61.Final Patch available GHSA-f256-j965-7f32
  • org.jboss.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-f256-j965-7f32
  • io.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-f256-j965-7f32

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.61Vulnerablenetty
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.61 Vulnerable ·netty
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*12.0.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:*7.4.2.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*1.4.10VulnerableOracle
cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.6.3VulnerableOracle
cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*before 21.1.12VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.12.0 – 17.12.11; 18.8.0 – 18.8.11; 19.12.0 – 19.12.10VulnerableOracle
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.13.7Vulnerablequarkusio
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:* Versions 7.4.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* Versions before 21.1.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.11; 19.12.0 – 19.12.10 Vulnerable ·Oracle
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.13.7 Vulnerable ·quarkusio

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.61.Final
  • Fix · GHSA-f256-j965-7f32 io.netty:netty-codec-http2 (Maven) Fixed in 4.1.61.Final Advisory →

Red Hat 21 advisories

  • RHSA-2022:5498 Released 2022-07-05 · Red Hat rating Moderate
    Satellite 6.11 Release
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:5129 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.3.1)
    • OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8
Show 18 more Red Hat advisories
  • RHSA-2021:5127 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.2.4)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:5128 Released 2021-12-14 · Red Hat rating Moderate
    Openshift Logging security and bug update (5.1.5)
    • OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8
  • RHSA-2021:3880 Released 2021-10-20 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.2.3 release and security update
    • Red Hat build of Quarkus 2.2.3
  • RHSA-2021:3700 Released 2021-09-30 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.9.0 release and security update
    • Red Hat AMQ 7.9.0
  • RHSA-2021:3660 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update
    • Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
  • RHSA-2021:3658 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
  • RHSA-2021:3656 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
  • RHSA-2021:3225 Released 2021-08-19 · Red Hat rating Moderate
    Red Hat AMQ Streams 1.8.0 release and security update
    • Red Hat AMQ Streams 1.8.0
  • RHSA-2021:2965 Released 2021-07-29 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.8 security update
    • Red Hat Single Sign-On 7.4.8
  • RHSA-2021:2755 Released 2021-07-15 · Red Hat rating Moderate
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:2694 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el8eap +47
  • RHSA-2021:2692 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 6 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el6eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el6eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el6eap +47
  • RHSA-2021:2693 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 7 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el7eap, eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el7eap +47
  • RHSA-2021:2696 Released 2021-07-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.8 security update
    • EAP 7.3.8
  • RHSA-2021:2689 Released 2021-07-12 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8.2 release and security update
    • Red Hat AMQ 7.8.2
  • RHSA-2021:2465 Released 2021-07-07 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.1.0 security update
    • Vert.x 4.1.0
  • RHSA-2021:2139 Released 2021-05-26 · Red Hat rating Critical
    Red Hat Data Grid 8.2.0 security update
    • Red Hat Data Grid 8.2.0
  • RHSA-2021:1511 Released 2021-05-06 · Red Hat rating Moderate
    AMQ Clients 2.9.1 release and security update
    • Red Hat AMQ Clients 2 python-qpid-proton-0.33.0-6.el7_9, python-qpid-proton-docs-0.33.0-6.el7_9, python-qpid-proton-docs-0.33.0-8.el8 +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat A-MQ OnlineAffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix yet
EAP 7.3.8Fixed RHSA-2021:2696
OpenShift Logging 5.1Fixed RHSA-2021:5128
OpenShift Logging 5.2Fixed RHSA-2021:5127
OpenShift Logging 5.3Fixed RHSA-2021:5129
Red Hat AMQ 7.8.2Fixed RHSA-2021:2689
Red Hat AMQ 7.9.0Fixed RHSA-2021:3700
Red Hat AMQ Clients 2Fixed RHSA-2021:1511
Red Hat AMQ Streams 1.8.0Fixed RHSA-2021:3225
Red Hat Data Grid 8.2.0Fixed RHSA-2021:2139
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:2755
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:2694
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:2692
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:2693
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:3656
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:3658
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:3660
Red Hat Satellite 6.11 for RHEL 7Fixed RHSA-2022:5498
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:5498
Red Hat Single Sign-On 7.4.8Fixed RHSA-2021:2965
Red Hat build of Quarkus 2.2.3Fixed RHSA-2021:3880
Vert.x 4.1.0Fixed RHSA-2021:2465
Not affected: 10 products
  • OpenShift Logging 5.1
  • OpenShift Logging 5.2
  • OpenShift Logging 5.3
  • Red Hat Decision Manager 7
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21409
  2. 2026-10-03 Alias added: GHSA-f256-j965-7f32
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: LOW → MEDIUM

References

Patch 5

Advisory 6

Other 100

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences