Orta CVSS 5.9

CVE-2021-21409: Netty: güvenlik açığı

Yayın: 30 Mart 2021 18:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

Özet bilgiler

Ürün: Netty Netty
CVSS v3.1: 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: %4,94 (yüzdelik 92)
CWE: CWE-444
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
netty-netty	—	—	4.1.61
debian-debian-linux	10.0	10.0	—
netapp-oncommand-api-services	—	—	—
netapp-oncommand-workflow-automation	—	—	—
oracle-banking-corporate-lending-process-management	14.2.0	14.2.0	—
oracle-banking-corporate-lending-process-management	14.3.0	14.3.0	—
oracle-banking-corporate-lending-process-management	14.5.0	14.5.0	—
oracle-banking-credit-facilities-process-management	14.2.0	14.2.0	—
oracle-banking-credit-facilities-process-management	14.3.0	14.3.0	—
oracle-banking-credit-facilities-process-management	14.5.0	14.5.0	—
oracle-banking-trade-finance-process-management	14.2.0	14.2.0	—
oracle-banking-trade-finance-process-management	14.3.0	14.3.0	—
oracle-banking-trade-finance-process-management	14.5.0	14.5.0	—
oracle-coherence	12.2.1.4.0	12.2.1.4.0	—
oracle-coherence	14.1.1.0.0	14.1.1.0.0	—
oracle-communications-brm-elastic-charging-engine	12.0.0.3	12.0.0.3	—
oracle-communications-cloud-native-core-console	1.7.0	1.7.0	—
oracle-communications-cloud-native-core-policy	1.14.0	1.14.0	—
oracle-communications-design-studio	7.4.2.0.0	7.4.2.0.0	—
oracle-communications-messaging-server	8.1	8.1	—
oracle-helidon	1.4.10	1.4.10	—
oracle-helidon	2.4.0	2.4.0	—
oracle-jd-edwards-enterpriseone-tools	—	—	9.2.6.3
oracle-nosql-database	—	—	21.1.12
oracle-primavera-gateway	17.12.0	17.12.11	—
oracle-primavera-gateway	18.8.0	18.8.11	—
oracle-primavera-gateway	19.12.0	19.12.10	—
quarkus-quarkus	—	1.13.7	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları