AIKIDO-2026-592216

netty-codec-http2 is vulnerable to HTTP Request Smuggling

HTTP Request SmugglingGHSA-cg2g-fxr4-mg8m Published Yesterday

High Risk

This Affects:

netty-codec-http2

4.1.0.Final - 4.1.137.Final

Fixed in 4.1.138.Final

4.2.0.Final - 4.2.17.Final

Fixed in 4.2.18.Final

Are you affected? Scan for Free

TL;DR

In HTTP/1-to-HTTP/2 conversion, HttpConversionUtil.toHttp2Headers() prioritizes the HTTP/1 Host header over the authority carried in an absolute-form request-target, contrary to RFC 9112 which requires the request-target authority to take precedence. A request such as GET http://allowed.example/admin with Host: attacker.example is validated by a gateway against allowed.example but forwarded upstream with :authority set to attacker.example. This enables host and tenant boundary bypass, cache poisoning, and unintended upstream routing. The fix gives the absolute-form authority precedence when building :authority.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application translates HTTP/1 messages to HTTP/2 (for example a proxy or protocol-converting gateway).