Log in Start free

Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M

CVE-2026-59900Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Medium 6.9

In plain English

A medium-severity security flaw in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-59900
Debian:13nettyno fix listedDEBIAN-CVE-2026-59900
Debian:14nettyno fix listedDEBIAN-CVE-2026-59900
Mavenio.netty:netty-codec-http24.2.16.FinalGHSA-c69g-56f8-xwqj
Mavenio.netty:netty-codec-http24.1.136.FinalGHSA-c69g-56f8-xwqj
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-59900

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Final, < 4.2.16.Final< 4.1.136.Final

Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References