~ / search / GHSA-f256-j965-7f32

GHSA-f256-j965-7f32

Possible request smuggling in HTTP/2 due missing validation of content-length

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21409

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-codec-http2 >= 4.0.0, < 4.1.61.Final 4.1.61.Final
Maven org.jboss.netty:netty < 4.0.0 no fix listed
Maven io.netty:netty < 4.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1 This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case. ### Patches This was fixed as part of 4.1.61.Final ### Workarounds Validation can be done by the user before proxy the request by validating the header.

References

External links from the advisory. They lead to third-party sites.