Read the docs
TI-2021-19603 Aliases CVE-2021-43797GHSA-wx5j-54mm-rqqq

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Priority LOW 34CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 21 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02884 86th percentileScored 2026-11-07
Fix Partial io.netty:netty-codec-http (Maven): 4.1.71.FinalRed Hat: 20 advisoriesRed Hat: 21 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettyup to 4.1.7.0.Final—No fix listedCNA
—io.netty:netty-codec-http (Maven)4.0.0 to before 4.1.71.Final4.1.71.FinalPatch availableGHSA-wx5j-54mm-rqqq
—org.jboss.netty:netty (Maven)all versions—No fix listedGHSA-wx5j-54mm-rqqq
—io.netty:netty (Maven)all versions—No fix listedGHSA-wx5j-54mm-rqqq
  • netty Vendornetty Affected up to 4.1.7.0.Final Fixed in — No fix listed CNA
  • io.netty:netty-codec-http (Maven) Vendor— Affected 4.0.0 to before 4.1.71.Final Fixed in 4.1.71.Final Patch available GHSA-wx5j-54mm-rqqq
  • org.jboss.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-wx5j-54mm-rqqq
  • io.netty:netty (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-wx5j-54mm-rqqq

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.71Vulnerablenetty
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.5.3Vulnerablequarkusio
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*2.7VulnerableOracle
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableOracle
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.71 Vulnerable ·netty
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.5.3 Vulnerable ·quarkusio
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*7.4.2VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*8.1VulnerableOracle
cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*1.4.10VulnerableOracle
cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:* Versions 1.4.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-wx5j-54mm-rqqq io.netty:netty-codec-http (Maven) Fixed in 4.1.71.Final Advisory →

Red Hat 20 advisories

  • RHSA-2022:7417 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update
    • Red Hat Single Sign-On 7.6.1
  • RHSA-2022:7411 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-1-5.el9sso, rh-sso7-javapackages-filesystem-6.0.0-7.el9sso, rh-sso7-javapackages-tools-6.0.0-7.el9sso +4
  • RHSA-2022:7410 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el8sso
Show 17 more Red Hat advisories
  • RHSA-2022:7409 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el7sso
  • RHSA-2022:6782 Released 2022-10-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.3 security update on RHEL 7
    • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-15.0.8-1.redhat_00001.1.el7sso
  • RHSA-2022:6787 Released 2022-10-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.3 security update
    • Red Hat Single Sign-On 7
  • RHSA-2022:6783 Released 2022-10-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.3 security update on RHEL 8
    • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-15.0.8-1.redhat_00001.1.el8sso
  • RHSA-2022:5903 Released 2022-08-04 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.13.0 security update
    • RHPAM 7.13.0 async
  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2022:5498 Released 2022-07-05 · Red Hat rating Moderate
    Satellite 6.11 Release
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
  • RHSA-2022:5101 Released 2022-06-16 · Red Hat rating Important
    Red Hat AMQ Broker 7.10.0 release and security update
    • Red Hat AMQ 7.10.0
  • RHSA-2022:4919 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el8eap +47
  • RHSA-2022:4918 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el7eap +47
  • RHSA-2022:4922 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.6.1-redhat-00003.jar, com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-4.1.72.Final-redhat-00001.jar +8
  • RHSA-2022:4623 Released 2022-05-18 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.7.5 release and security update
    • Red Hat build of Quarkus 2.7.5
  • RHSA-2022:2217 Released 2022-05-11 · Red Hat rating Moderate
    Red Hat OpenShift Logging Security and Bug update Release 5.3.7
    • OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8 +1
  • RHSA-2022:2218 Released 2022-05-11 · Red Hat rating Moderate
    Openshift Logging Security and Bug update Release (5.2.10)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8 +1
  • RHSA-2022:2216 Released 2022-05-11 · Red Hat rating Moderate
    Red Hat OpenShift Logging Security and Bug update Release 5.4.1
    • RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8
  • RHSA-2022:1345 Released 2022-04-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.1.0 release and security update
    • Red Hat AMQ Streams 2.1.0
  • RHSA-2022:0520 Released 2022-02-14 · Red Hat rating Moderate
    Red Hat Data Grid 8.3.0 security update
    • Red Hat Data Grid 8.3.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
OpenShift Logging 5.2Fixed RHSA-2022:2218
OpenShift Logging 5.3Fixed RHSA-2022:2217
RHOL 5.4 for RHEL 8Fixed RHSA-2022:2216
RHPAM 7.13.0 asyncFixed RHSA-2022:5903
Red Hat AMQ 7.10.0Fixed RHSA-2022:5101
Red Hat AMQ Streams 2.1.0Fixed RHSA-2022:1345
Red Hat Data Grid 8.3.0Fixed RHSA-2022:0520
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:4918
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:4919
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:4922
Red Hat Satellite 6.11 for RHEL 7Fixed RHSA-2022:5498
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:5498
Red Hat Single Sign-On 7Fixed RHSA-2022:6787
Red Hat Single Sign-On 7.5 for RHEL 7 ServerFixed RHSA-2022:6782
Red Hat Single Sign-On 7.5 for RHEL 8Fixed RHSA-2022:6783
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2022:7409
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2022:7410
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2022:7411
Red Hat Single Sign-On 7.6.1Fixed RHSA-2022:7417
Red Hat build of Quarkus 2.7.5Fixed RHSA-2022:4623
Not affected: 11 products
  • OpenShift Logging 5.2
  • OpenShift Logging 5.3
  • RHOL 5.4 for RHEL 8
  • Red Hat A-MQ Online
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43797
  2. 2026-10-03 Alias added: GHSA-wx5j-54mm-rqqq
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 3

Advisory 5

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences