AIKIDO-2026-453463
netty-codec-http2 is vulnerable to HTTP Request Smuggling
35
Low Risk
This Affects:
netty-codec-http2TL;DR
Netty's HTTP/2 stack does not validate header field values by default: names use a validator but values default to no validation and the encode path performs no checks. Prohibited octets such as NUL, CR, and LF therefore pass through verbatim on inbound and outbound HTTP/2 headers, contrary to RFC 9113. When the traffic is later translated to HTTP/1.1 by a proxy or gateway where CR and LF are delimiters, this enables request smuggling and response splitting. The fix enables header-value validation by default.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you emit or forward HTTP/2 traffic that is later translated to HTTP/1.1 by a downstream proxy or gateway.
Background info
netty-codec-http2 is vulnerable to HTTP Request Smuggling in versions 0.0.1 - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-http2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.