Possible request smuggling in HTTP/2 due missing validation of content-length
Summary
| CVE | CVE-2021-21409 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-03-30 15:15:14 UTC |
| Updated | 2026-10-08 22:17:06 UTC |
| Description | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.049350000 probability, percentile 0.920600000 (date 2026-10-20)
Problem Types: CWE-444 | CWE-444 CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | CNA | DECLARED | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Application | Netapp | Oncommand Api Services | - | All | All | All |
| Application | Netapp | Oncommand Workflow Automation | - | All | All | All |
| Application | Netty | Netty | All | All | All | All |
| Application | Oracle | Banking Corporate Lending Process Management | 14.2.0 | All | All | All |
| Application | Oracle | Banking Corporate Lending Process Management | 14.3.0 | All | All | All |
| Application | Oracle | Banking Corporate Lending Process Management | 14.5.0 | All | All | All |
| Application | Oracle | Banking Credit Facilities Process Management | 14.2.0 | All | All | All |
| Application | Oracle | Banking Credit Facilities Process Management | 14.3.0 | All | All | All |
| Application | Oracle | Banking Credit Facilities Process Management | 14.5.0 | All | All | All |
| Application | Oracle | Banking Trade Finance Process Management | 14.2.0 | All | All | All |
| Application | Oracle | Banking Trade Finance Process Management | 14.3.0 | All | All | All |
| Application | Oracle | Banking Trade Finance Process Management | 14.5.0 | All | All | All |
| Application | Oracle | Coherence | 12.2.1.4.0 | All | All | All |
| Application | Oracle | Coherence | 14.1.1.0.0 | All | All | All |
| Application | Oracle | Communications Brm - Elastic Charging Engine | 12.0.0.3 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Console | 1.7.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Policy | 1.14.0 | All | All | All |
| Application | Oracle | Communications Design Studio | 7.4.2.0.0 | All | All | All |
| Application | Oracle | Communications Messaging Server | 8.1 | All | All | All |
| Application | Oracle | Helidon | 1.4.10 | All | All | All |
| Application | Oracle | Helidon | 2.4.0 | All | All | All |
| Application | Oracle | Jd Edwards Enterpriseone Tools | All | All | All | All |
| Application | Oracle | Nosql Database | All | All | All | All |
| Application | Oracle | Primavera Gateway | All | All | All | All |
| Application | Oracle | Primavera Gateway | All | All | All | All |
| Application | Oracle | Primavera Gateway | All | All | All | All |
| Application | Quarkus | Quarkus | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Merge pull request from GHSA-f256-j965-7f32 · netty/netty@b0fa4d5 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Third Party Advisory |
| lists.apache.org/thread.html/rca0978b634a0c3ebee4126ec29c7f570b165fae3f8f36587... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Oracle Critical Patch Update Advisory - April 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| lists.apache.org/thread.html/rd4a6b7dec38ea6cd28b6f94bd4b312629a52b80be3786d5f... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/ra655e5cec74d1ddf62adacb71d398abd96f3ea2c588f6bbf... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e3332... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/ra64d56a8a331ffd7bdcd24a9aaaeeedeacd5d639f5a68338... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| CVE - CVE-2021-21295 | af854a3a-2127-422b-91ae-364da2661108 | cve.mitre.org | Third Party Advisory |
| lists.apache.org/thread.html/r69efd8ef003f612c43e4154e788ca3b1f837feaacd16d978... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/re1911e05c08f3ec2bab85744d788773519a0afb27272a31a... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r70c3a7bfa904f06a1902f4df20ee26e4f09a46b8fd3eb304... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Oracle Critical Patch Update Advisory - October 2021 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| lists.apache.org/thread.html/re9e6ed60941da831675de2f8f733c026757fb4fa28a7b6c9... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r855b4b6814ac829ce2d48dd9d8138d07f33387e710de798e... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/re39391adcb863f0e9f3f15e7986255948f263f02e4700b82... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Oracle Critical Patch Update Advisory - July 2021 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| lists.apache.org/thread.html/rf521ff2be2e2dd38984174d3451e6ee935c845948845c8fc... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r7b54563abebe3dbbe421e1ba075c2030d8d460372f8c79b7... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r7879ddcb990c835c6b246654770d836f9d031dee982be836... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/ra66e93703e3f4bd31bdfd0b6fb0c32ae96b528259bb1aa2b... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r4ea2f1a9d79d4fc1896e085f31fb60a21b1770d0a26a5250... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/re4b0141939370304d676fe23774d0c6fbc584b6489198254... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rf934292a4a1c189827f625d567838d2c1001e4739b158638... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r967002f0939e69bdec58f070735a19dd57c1f2b8f817949c... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Possible request smuggling in HTTP/2 due missing validation of content-length · Advisory · netty/netty · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Third Party Advisory |
| lists.apache.org/thread.html/r602e98daacc98934f097f07f2eed6eb07c18bfc1949c8489... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Oracle Critical Patch Update Advisory - January 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| lists.apache.org/thread.html/r0ca82fec33334e571fe5b388272260778883e307e15415d7... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Debian -- Security Information -- DSA-4885-1 netty | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| lists.apache.org/thread.html/r101f82d8f3b5af0bf79aecbd5b2dd3b404f6bb51d1a54c2c... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/redef0fb5474fd686781007de9ddb852b24f1b04131a248d9... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r5f2f120b2b8d099226473db1832ffb4d7c1d6dc2d228a164... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rafc77f9f03031297394f3d372ccea751b23576f8a2ae9b6b... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rdd206d9dd7eb894cc089b37fe6edde2932de88d63a6d8368... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rdd5715f3ee5e3216d5e0083a07994f67da6dbb9731ce9e7a... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r823d4b27fcba8dad5fe945bdefce3ca5a0031187966eb6ef... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r4b8be87acf5b9c098a2ee350b5ca5716fe7afeaf0a21a4ee... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r61564d86a75403b854cdafee67fc69c8b88c5f6802c2c838... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r5cbea8614812289a9b98d0cfc54b47f54cef424ac98d5e31... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r4a98827bb4a7edbd69ef862f2351391845697c40711820d1... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r2732aa3884cacfecac4c54cfaa77c279ba815cad44b464a5... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r9fe840c36b74f92b8d4a089ada1f9fd1d6293742efa18b10... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/raa413040db6d2197593cc03edecfd168732e697119e6447b... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rf148b2bf6c2754153a8629bc7495e216bd0bd4c915695486... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r31044fb995e894749cb821c6fe56f487c16a97028e6e360e... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r9ec78dc409f3f1edff88f21cab53737f36aad46f582a9825... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r6dac9bd799ceac499c7a7e152a9b0dc7f2fe7f89ec5605d1... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rbde2f13daf4911504f0eaea43eee4f42555241b5f6d9d715... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r1b3cb056364794f919aaf26ceaf7423de64e7fdd05a91406... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Possible request smuggling in HTTP/2 due missing validation · Advisory · netty/netty · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Third Party Advisory |
| lists.apache.org/thread.html/rf38e4dcdefc7c59f7ba0799a399d6d6e37b555d406a1dfc2... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rcae42fba06979934208bbd515584b241d3ad01d1bb8b0635... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r0b09f3e31e004fe583f677f7afa46bd30110904576c13c5a... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rba2a9ef1d0af882ab58fadb336a58818495245dda43d32a7... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| March 2021 Apache Netty Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | Third Party Advisory |
| lists.apache.org/thread.html/rac8cf45a1bab9ead5c9a860cbadd6faaeb7792203617b6ec... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178527 Debian Security Update for netty (DSA 4885-1)
- 179514 Debian Security Update for netty (CVE-2021-21409)
- 199574 Ubuntu Security Notification for Netty Vulnerabilities (USN-6049-1)
- 239478 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 (RHSA-2021:2694)
- 239479 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 7 (RHSA-2021:2693)
- 239480 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 6 (RHSA-2021:2692)
- 239652 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.4.1 (RHSA-2021:3658)
- 239653 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.4.1 (RHSA-2021:3656)
- 239741 Red Hat Update for amq clients 2.9.1 release and (RHSA-2021:1511)
- 240566 Red Hat Update for Satellite 6.11 Release (RHSA-2022:5498)
- 960505 Rocky Linux Security Update for Satellite (RLSA-2022:5498)
- 980348 Java (maven) Security Update for io.netty:netty-codec-http2 (GHSA-f256-j965-7f32)