CVE-2021-43797HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Updated under an hour ago ()
Does this affect you?
It affects netty and 17 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-444
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
netty netty netty:netty (from the name) | through 4.1.7.0.Final | CNA record |
netty netty netty:netty | before 4.1.71 | NVD |
quarkus quarkus quarkus:quarkus | before 2.5.3 | NVD |
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation | all versions | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
oracle banking_deposits_and_lines_of_credit_servicing oracle:banking_deposits_and_lines_of_credit_servicing | 2.7 | NVD |
oracle banking_party_management oracle:banking_party_management | 2.7.0 | NVD |
oracle banking_platform oracle:banking_platform | 2.6.2 | NVD |
oracle coherence oracle:coherence | 12.2.1.4.0; 14.1.1.0.0 | NVD |
oracle communications_cloud_native_core_binding_support_function oracle:communications_cloud_native_core_binding_support_function | 1.11.0 | NVD |
oracle communications_cloud_native_core_network_slice_selection_function oracle:communications_cloud_native_core_network_slice_selection_function | 1.8.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.15.0 | NVD |
oracle communications_cloud_native_core_security_edge_protection_proxy oracle:communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | NVD |
oracle communications_cloud_native_core_unified_data_repository oracle:communications_cloud_native_core_unified_data_repository | 1.15.0 | NVD |
oracle communications_design_studio oracle:communications_design_studio | 7.4.2 | NVD |
oracle communications_instant_messaging_server oracle:communications_instant_messaging_server | 8.1 | NVD |
oracle helidon oracle:helidon | 1.4.10; 2.4.0 | NVD |
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools | 8.58; 8.59 | NVD |
debian debian_linux debian:debian_linux | 10.0; 11.0 | NVD |
References
- https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
- https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220107-0003/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlmailing-list
- https://www.debian.org/security/2023/dsa-5316vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.