Back to CVE records
Medium 5.9Published Mar 30, 2021
CVE-2021-21409Possible request smuggling in HTTP/2 due missing validation of content-length
Updated under an hour ago ()
Does this affect you?
It affects netty and 17 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
- CVSS
- 5.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-444
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
netty netty netty:netty (from the name) | before 4.1.61.Final | CNA record |
netty netty netty:netty | before 4.1.61 | NVD |
debian debian_linux debian:debian_linux | 10.0 | NVD |
netapp oncommand_api_services netapp:oncommand_api_services | all versions | NVD |
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation | all versions | NVD |
oracle banking_corporate_lending_process_management oracle:banking_corporate_lending_process_management | 14.2.0; 14.3.0; 14.5.0 | NVD |
oracle banking_credit_facilities_process_management oracle:banking_credit_facilities_process_management | 14.2.0; 14.3.0; 14.5.0 | NVD |
oracle banking_trade_finance_process_management oracle:banking_trade_finance_process_management | 14.2.0; 14.3.0; 14.5.0 | NVD |
oracle coherence oracle:coherence | 12.2.1.4.0; 14.1.1.0.0 | NVD |
oracle communications_brm_-_elastic_charging_engine oracle:communications_brm_-_elastic_charging_engine | 12.0.0.3 | NVD |
oracle communications_cloud_native_core_console oracle:communications_cloud_native_core_console | 1.7.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.14.0 | NVD |
oracle communications_design_studio oracle:communications_design_studio | 7.4.2.0.0 | NVD |
oracle communications_messaging_server oracle:communications_messaging_server | 8.1 | NVD |
oracle helidon oracle:helidon | 1.4.10; 2.4.0 | NVD |
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools | before 9.2.6.3 | NVD |
oracle nosql_database oracle:nosql_database | before 21.1.12 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.11; from 19.12.0 through 19.12.10 | NVD |
quarkus quarkus quarkus:quarkus | through 1.13.7 | NVD |
References
- https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32x-refsource-confirm
- https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpjx-refsource-misc
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295x-refsource-misc
- https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432x-refsource-misc
- https://www.debian.org/security/2021/dsa-4885vendor-advisory, x-refsource-debian
- https://lists.apache.org/thread.html/r70c3a7bfa904f06a1902f4df20ee26e4f09a46b8fd3eb304dc57a2de%40%3Cdev.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/ra66e93703e3f4bd31bdfd0b6fb0c32ae96b528259bb1aa2b6d38e401%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2732aa3884cacfecac4c54cfaa77c279ba815cad44b464a567216f83%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r0ca82fec33334e571fe5b388272260778883e307e15415d7b1443de2%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r823d4b27fcba8dad5fe945bdefce3ca5a0031187966eb6ef3cc22ba9%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r101f82d8f3b5af0bf79aecbd5b2dd3b404f6bb51d1a54c2c3d29bed9%40%3Cnotifications.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rf521ff2be2e2dd38984174d3451e6ee935c845948845c8fccd86371d%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r5cbea8614812289a9b98d0cfc54b47f54cef424ac98d5e315b791795%40%3Cnotifications.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rdd206d9dd7eb894cc089b37fe6edde2932de88d63a6d8368b44f5101%40%3Ccommits.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rac8cf45a1bab9ead5c9a860cbadd6faaeb7792203617b6ec3874736d%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4a98827bb4a7edbd69ef862f2351391845697c40711820d10df52ca5%40%3Ccommits.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r69efd8ef003f612c43e4154e788ca3b1f837feaacd16d97854402355%40%3Ccommits.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4b8be87acf5b9c098a2ee350b5ca5716fe7afeaf0a21a4ee45a90687%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/re4b0141939370304d676fe23774d0c6fbc584b648919825402d0cb39%40%3Cnotifications.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rdd5715f3ee5e3216d5e0083a07994f67da6dbb9731ce9e7a6389b18e%40%3Ccommits.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1b3cb056364794f919aaf26ceaf7423de64e7fdd05a914066e7d5219%40%3Cissues.zookeeper.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rf38e4dcdefc7c59f7ba0799a399d6d6e37b555d406a1dfc2fcbf0b35%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r61564d86a75403b854cdafee67fc69c8b88c5f6802c2c838f4282cc8%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r7879ddcb990c835c6b246654770d836f9d031dee982be836744e50ed%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e33324b70a06a%40%3Cissues.flink.apache.org%3Emailing-list, x-refsource-mlist
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.