AIKIDO-2026-58442
netty-codec-http2 is vulnerable to HTTP Request Smuggling
75
High Risk
This Affects:
netty-codec-http2TL;DR
When converting HTTP/2 Extended CONNECT requests to HTTP/1.1, Netty downgrades them to ordinary CONNECT tunnels by dropping the :protocol pseudo-header and the Extended-CONNECT :path. A request carrying :protocol=websocket and :path=/admin/ws to :authority=ws.example:443 becomes a plain CONNECT tunnel to that host, stripping the metadata downstream handlers use for routing and authorization. Policies that distinguish protocol types can therefore be bypassed. The fix preserves Extended CONNECT semantics instead of silently downgrading.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application translates HTTP/2 Extended CONNECT requests to HTTP/1 (for example a proxy or protocol-converting gateway).
Background info
netty-codec-http2 is vulnerable to HTTP Request Smuggling in versions 4.1.64.Final - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-http2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.