GHSA-f256-j965-7f32 · Severity: medium · Ecosystem: maven — Possible request smuggling in HTTP/2 due missing validation of content-length
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
Conclusion & alert: CVE-2021-21409 is rated Moderate Risk (54.7/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 3.16%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-07 | 2.55% | 3.16% | +0.61% |
| 2 | 2026-03-05 | 3.16% | 2.55% | -0.61% |
| 3 | 2026-03-04 | — | 3.16% | — |
Full EPSS history (59 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.9 | 3.1 | MEDIUM |
|
2.2 | 3.6 | [email protected] |
| 5.9 | 3.1 | MEDIUM |
|
2.2 | 3.6 | [email protected] |
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
GHSA-f256-j965-7f32 · Severity: medium · Ecosystem: maven — Possible request smuggling in HTTP/2 due missing validation of content-length
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2021-21409 not yet assigned priority: Debian including 1 source packages (netty), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-21409 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-21409 |
suse
|
medium | CVE-2021-21409 severity moderate: SUSE including 10 source package names (5.0.0-beta1.2.122:netty-4.1.75-150200.4.9.1, 5.1.0.6.40:netty-4.1.75-150200.4.9.1, …), 33 product×package rows across 29 product lines (Container suse/manager/5.0/x86_64/server, Container suse/multi-linux-manager/5.1/x86_64/server, … (29 product lines)): Known Not Affected 17, Fixed 16. | https://www.suse.com/security/cve/CVE-2021-21409/ |
ubuntu
|
medium | CVE-2021-21409 medium priority: Ubuntu including 1 source packages (netty), 16 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): released 10, ignored 5, needs-triage 1. | https://ubuntu.com/security/CVE-2021-21409 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| netty | netty | < 4.1.61 | cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* |
| debian | debian_linux | 10.0 | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| netapp | oncommand_api_services | — | cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* |
| netapp | oncommand_workflow_automation | — | cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| oracle | banking_corporate_lending_process_management | 14.2.0 | cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* |
| oracle | banking_corporate_lending_process_management | 14.3.0 | cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* |
| oracle | banking_corporate_lending_process_management | 14.5.0 | cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* |
| oracle | banking_credit_facilities_process_management | 14.2.0 | cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* |
| oracle | banking_credit_facilities_process_management | 14.3.0 | cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* |
| oracle | banking_credit_facilities_process_management | 14.5.0 | cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* |
| oracle | banking_trade_finance_process_management | 14.2.0 | cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* |
| oracle | banking_trade_finance_process_management | 14.3.0 | cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* |
| oracle | banking_trade_finance_process_management | 14.5.0 | cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* |
| oracle | coherence | 12.2.1.4.0 | cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | coherence | 14.1.1.0.0 | cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:* |
| oracle | communications_brm_-_elastic_charging_engine | 12.0.0.3 | cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_console | 1.7.0 | cpe:2.3:a:oracle:communications_cloud_native_core_console:1.7.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_policy | 1.14.0 | cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* |
| oracle | communications_design_studio | 7.4.2.0.0 | cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:* |
| oracle | communications_messaging_server | 8.1 | cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* |
| oracle | helidon | 1.4.10 | cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:* |
| oracle | helidon | 2.4.0 | cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:* |
| oracle | jd_edwards_enterpriseone_tools | < 9.2.6.3 | cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* |
| oracle | nosql_database | < 21.1.12 | cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* |
| oracle | primavera_gateway | >= 17.12.0, <= 17.12.11 | cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* |
| oracle | primavera_gateway | >= 18.8.0, <= 18.8.11 | cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* |
| oracle | primavera_gateway | >= 19.12.0, <= 19.12.10 | cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* |
| quarkus | quarkus | <= 1.13.7 | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |