AIKIDO-2026-918525
netty-codec-http2 is vulnerable to HTTP Request Smuggling
75
High Risk
This Affects:
netty-codec-http2TL;DR
During HTTP/1-to-HTTP/2 conversion, HttpConversionUtil.toHttp2Headers() does not special-case an HTTP/1 CONNECT request in authority-form. Instead of deriving :authority from the CONNECT request-target, it uses the HTTP/1 Host header, producing a malformed HTTP/2 CONNECT whose :authority is Host-controlled. In proxy and gateway deployments this can bypass tunnel-destination checks and enable request smuggling. The fix derives :authority from the authority-form request-target for CONNECT.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application translates HTTP/1 messages to HTTP/2 (for example a proxy or protocol-converting gateway).
Background info
netty-codec-http2 is vulnerable to HTTP Request Smuggling in versions 4.1.0.Final - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-http2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.