CVE-2021-43797

MEDIUM
Published Dec 9, 20214y ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Dec 9, 2021 4y ago
Last Modified Jun 17, 2026 1w ago

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-444

Affected Products 22

VendorProductVersionRange
nettynetty* <4.1.71
quarkusquarkus* <2.5.3
netapponcommand_workflow_automation*any
netappsnapcenter*any
oraclebanking_deposits_and_lines_of_credit_servicing2.7any
oraclebanking_party_management2.7.0any
oraclebanking_platform2.6.2any
oraclecoherence12.2.1.4.0any
oraclecoherence14.1.1.0.0any
oraclecommunications_cloud_native_core_binding_support_function1.11.0any
oraclecommunications_cloud_native_core_network_slice_selection_function1.8.0any
oraclecommunications_cloud_native_core_policy1.15.0any
oraclecommunications_cloud_native_core_security_edge_protection_proxy1.7.0any
oraclecommunications_cloud_native_core_unified_data_repository1.15.0any
oraclecommunications_design_studio7.4.2any
oraclecommunications_instant_messaging_server8.1any
oraclehelidon1.4.10any
oraclehelidon2.4.0any
oraclepeoplesoft_enterprise_peopletools8.58any
oraclepeoplesoft_enterprise_peopletools8.59any
debiandebian_linux10.0any
debiandebian_linux11.0any

References 7

  • github.com https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
    PatchThird Party Advisory
  • github.com https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
    Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
    Mailing ListThird Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20220107-0003/
    Third Party Advisory
  • debian.org https://www.debian.org/security/2023/dsa-5316
    Third Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory