Description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netty | io.netty:netty-codec-http2 | < 4.1.60.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.48-3 | — |
| Debian 13 | netty | 1:4.1.48-3 | — |
| Debian 12 | netty | 1:4.1.48-3 | — |
| Debian 10 | netty | 1:4.1.33-1+deb10u2 | DSA-4885-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | USN-6049-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | netty | 1:4.1.45-1ubuntu0.1~esm1 | USN-6049-1 |
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm2 | USN-6049-1 |
| Ubuntu Pro 16.04 LTS | netty | 1:4.0.34-1ubuntu0.1~esm1 | USN-6049-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Utils 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | candlepin | 4.1.13-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-actionpack | 6.0.4.7-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-puma | 5.6.2-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-sidekiq | 5.2.10-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-actionpack | 6.0.4.7-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.6.2-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-sidekiq | 5.2.10-1.el7sat | RHSA-2022:5498 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.10.0-1.redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.4-1.redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.68.0-2.redhat_00005.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.14-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.22-3.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.30-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-2.redhat_00006.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.9-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-6.Final_redhat_00007.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jboss-weld-3.1-api +2 | 3.1.0-6.SP3_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jgroups-kubernetes | 1.0.16-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.4.3-2.Final_redhat_00002.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.60-1.Final_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.11.4-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.35-1.SP1_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-velocity +1 | 2.3.0-1.redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.6-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.7-1.GA_redhat_00002.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.12-1.Final_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.26-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.7-1.GA_redhat_00002.1.el7eap | RHSA-2021:3656, RHSA-2021:2047 |
| Red Hat JBoss EAP 7 | eap7-xalan-j2 | 2.7.1-36.redhat_00013.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.9-1.redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat A Mq Clients 2 | python3-qpid-proton | 0.33.0-8.el8 | RHSA-2021:1511 |
| Red Hat A Mq Clients 2 | qpid-proton +10 | 0.33.0-6.el7_9 | RHSA-2021:1511 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:5498 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.60-1.4 | openSUSE-SU-2024:11085-1 |
| openSUSE Leap 15.3 | netty | 4.1.75-150200.4.6.2 | SUSE-SU-2022:1271-1 |
| openSUSE Leap 15.2 | netty | 4.1.13-lp152.3.3.1 | openSUSE-SU-2021:0448-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty | all versions | — | GHSA-wm47-8v5p-wjpj |
| Maven | io.netty:netty-codec-http2 | >= 4.0.0, < 4.1.60.Final | 4.1.60.Final | GHSA-wm47-8v5p-wjpj |
| Maven | org.jboss.netty:netty | all versions | — | GHSA-wm47-8v5p-wjpj |
Advisories 17
- RHSA-2022:5498 Red Hat Security Advisory: Satellite 6.11 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3656 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2048 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2046 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2047 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:1511 Red Hat Security Advisory: AMQ Clients 2.9.1 release and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6049-1 netty vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4885-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:5498 Moderate: Satellite 6.11 Release Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2021:0448-1 Security update for netty SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11085-1 netty-4.1.60-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1271-1 Security update for netty SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- WID-SEC-2022-0567 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 22, 2023
References
- https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj
- https://github.com/Netflix/zuul/pull/980
- https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4
- [ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 mailing-list
- [ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 mailing-list
- [pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 mailing-list
- [pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final mailing-list
- [pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 mailing-list
- [bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final mailing-list
- [zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210331 [jira] [Assigned] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210331 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210331 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr commented on pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [kafka-jira] 20210331 [GitHub] [kafka] dongjinleekr opened a new pull request #10448: KAFKA-12583: Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad commented on pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] arshadmohammad closed pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-notifications] 20210331 [GitHub] [zookeeper] asfgit closed pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-commits] 20210331 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-commits] 20210331 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-commits] 20210331 [zookeeper] branch master updated: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-commits] 20210331 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4272 ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210331 [jira] [Resolved] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210401 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [kafka-dev] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [kafka-jira] 20210401 [jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [kafka-jira] 20210401 [jira] [Resolved] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- [zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell merged pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] HorizonNet commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [jira] [Assigned] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell opened a new pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] apurtell commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [jira] [Updated] (HBASE-25728) [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-commits] 20210402 [hbase-thirdparty] branch master updated: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 (#48) mailing-list
- [hbase-dev] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [GitHub] [hbase-thirdparty] Apache-HBase commented on pull request #48: HBASE-25728 [hbase-thirdparty] Upgrade Netty library to >= 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [hbase-issues] 20210402 [jira] [Created] (HBASE-25728) [hbase-thirdparty] ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
- [kafka-jira] 20210402 [jira] [Assigned] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
- DSA-4885 vendor-advisory
- [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [jackrabbit-dev] 20210709 [GitHub] [jackrabbit-oak] blackat opened a new pull request #321: Update netty to resolve CVE-2021-21295 and BDSA-2018-4022 mailing-list
- https://security.netapp.com/advisory/ntap-20210604-0003/
- [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 mailing-list