Attacker Value
Unknown
CVE-2021-21409
CVE-2021-21409
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
5.9 Medium
Impact Score:
3.6
Exploitability Score:
2.2
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
High
Availability (A):
None
General Information
Vendors
- debian,
- netapp,
- netty,
- oracle,
- quarkus
Products
- banking corporate lending process management 14.2.0,
- banking corporate lending process management 14.3.0,
- banking corporate lending process management 14.5.0,
- banking credit facilities process management 14.2.0,
- banking credit facilities process management 14.3.0,
- banking credit facilities process management 14.5.0,
- banking trade finance process management 14.2.0,
- banking trade finance process management 14.3.0,
- banking trade finance process management 14.5.0,
- coherence 12.2.1.4.0,
- coherence 14.1.1.0.0,
- communications brm - elastic charging engine 12.0.0.3,
- communications cloud native core console 1.7.0,
- communications cloud native core policy 1.14.0,
- communications design studio 7.4.2.0.0,
- communications messaging server 8.1,
- debian linux 10.0,
- helidon 1.4.10,
- helidon 2.4.0,
- jd edwards enterpriseone tools,
- netty,
- nosql database,
- oncommand api services -,
- oncommand workflow automation -,
- primavera gateway,
- quarkus
References
Advisory
Miscellaneous
