Description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netty | netty | < 4.1.61.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.48-4 | — |
| Debian 13 | netty | 1:4.1.48-4 | — |
| Debian 12 | netty | 1:4.1.48-4 | — |
| Debian 10 | netty | 1:4.1.33-1+deb10u2 | DSA-4885-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | USN-6049-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | netty | 1:4.1.45-1ubuntu0.1~esm1 | USN-6049-1 |
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm2 | USN-6049-1 |
| Ubuntu Pro 16.04 LTS | netty | 1:4.0.34-1ubuntu0.1~esm1 | USN-6049-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Utils 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | candlepin | 4.1.13-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-actionpack | 6.0.4.7-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-puma | 5.6.2-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-sidekiq | 5.2.10-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-actionpack | 6.0.4.7-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.6.2-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-sidekiq | 5.2.10-1.el7sat | RHSA-2022:5498 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.10.0-1.redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.6.3-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.15-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.20-3.SP1_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.23-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.33-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-2.redhat_00006.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.8-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.23-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-7.Final_redhat_00008.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.38-1.SP1_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694 |
| Red Hat JBoss EAP 7 | eap7-velocity +1 | 2.3.0-1.redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.8-1.GA_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.13-1.Final_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2694 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.28-1.Final_redhat_00001.1.el6eap | RHSA-2021:2694, RHSA-2021:2693, RHSA-2021:2692 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.8-1.GA_redhat_00001.1.el7eap | RHSA-2021:3656, RHSA-2021:2693 |
| Red Hat A Mq Clients 2 | python3-qpid-proton | 0.33.0-8.el8 | RHSA-2021:1511 |
| Red Hat A Mq Clients 2 | qpid-proton +10 | 0.33.0-6.el7_9 | RHSA-2021:1511 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:5498 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.114-1.1 | openSUSE-SU-2024:14442-1 |
| openSUSE Leap 15.3 | netty | 4.1.75-150200.4.9.1 | SUSE-SU-2022:1315-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty | all versions | — | GHSA-f256-j965-7f32 |
| Maven | io.netty:netty-codec-http2 | >= 4.0.0, < 4.1.61.Final | 4.1.61.Final | GHSA-f256-j965-7f32 |
| Maven | org.jboss.netty:netty | all versions | — | GHSA-f256-j965-7f32 |
Advisories 15
- RHSA-2022:5498 Red Hat Security Advisory: Satellite 6.11 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3656 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2694 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2693 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2692 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:1511 Red Hat Security Advisory: AMQ Clients 2.9.1 release and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6049-1 netty vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4885-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:5498 Moderate: Satellite 6.11 Release Rocky Linux Security Advisories · Feb 5, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- openSUSE-SU-2024:14442-1 netty-4.1.114-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2022:1315-1 Security update for netty SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
References
- https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32
- https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295
- https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432
- DSA-4885 vendor-advisory
- [zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210408 [jira] [Comment Edited] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210408 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-notifications] 20210408 [GitHub] [zookeeper] ayushmantri opened a new pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210408 [jira] [Updated] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-notifications] 20210408 [GitHub] [zookeeper] arshadmohammad commented on pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-commits] 20210408 [zookeeper] branch master updated: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210408 [jira] [Resolved] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-commits] 20210408 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-commits] 20210408 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210408 [jira] [Assigned] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-notifications] 20210408 [GitHub] [zookeeper] asfgit closed pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-commits] 20210408 [zookeeper] 01/02: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210409 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [pulsar-commits] 20210419 [GitHub] [pulsar] lhotari opened a new pull request #10266: [Security] Upgrade Netty to 4.1.63.Final to address CVE-2021-21409 mailing-list
- [pulsar-commits] 20210419 [GitHub] [pulsar] lhotari commented on pull request #10266: [Security] Upgrade Netty to 4.1.63.Final to address CVE-2021-21409 mailing-list
- [pulsar-commits] 20210420 [GitHub] [pulsar] eolivelli merged pull request #10266: [Security] Upgrade Netty to 4.1.63.Final to address CVE-2021-21409 mailing-list
- [flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [kafka-jira] 20210506 [GitHub] [kafka] dongjinleekr opened a new pull request #10642: KAFKA-12756: Update Zookeeper to 3.6.3 or higher mailing-list
- [flink-issues] 20210511 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [zookeeper-issues] 20210517 [jira] [Updated] (ZOOKEEPER-4295) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21409 in branch-3.5 mailing-list
- [zookeeper-issues] 20210517 [jira] [Created] (ZOOKEEPER-4295) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21409 in branch-3.5 mailing-list
- [zookeeper-dev] 20210517 [jira] [Created] (ZOOKEEPER-4295) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21409 in branch-3.5 mailing-list
- [zookeeper-notifications] 20210517 [GitHub] [zookeeper] gpiyush-dev opened a new pull request #1696: ZOOKEEPER-4295: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21409 in branch-3.5 mailing-list
- [zookeeper-notifications] 20210521 [GitHub] [zookeeper] maoling commented on pull request #1696: ZOOKEEPER-4295: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21409 in branch-3.5 mailing-list
- [flink-issues] 20210610 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [flink-issues] 20210618 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://security.netapp.com/advisory/ntap-20210604-0003/
- [zookeeper-issues] 20210727 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210727 [jira] [Comment Edited] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-notifications] 20210727 [GitHub] [zookeeper] sandipbhattacharya commented on pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [kudu-issues] 20210904 [jira] [Created] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 mailing-list
- [kudu-issues] 20210904 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 mailing-list
- [kudu-issues] 20210907 [jira] [Resolved] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 mailing-list
- [kudu-issues] 20210907 [jira] [Commented] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 mailing-list
- [kudu-issues] 20210907 [jira] [Updated] (KUDU-3313) There is a CVE-2021-21409 vulnerability in netty version 4.1.60 mailing-list
- [zookeeper-issues] 20210922 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210923 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210923 [jira] [Created] (ZOOKEEPER-4385) Backport ZOOKEEPER-4278 to branch-3.5 to Address CVE-2021-21409 mailing-list
- [zookeeper-dev] 20210923 [jira] [Created] (ZOOKEEPER-4385) Backport ZOOKEEPER-4278 to branch-3.5 to Address CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210923 [jira] [Assigned] (ZOOKEEPER-4385) Backport ZOOKEEPER-4278 to branch-3.5 to Address CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210923 [jira] [Updated] (ZOOKEEPER-4385) Backport ZOOKEEPER-4278 to branch-3.5 to Address CVE-2021-21409 mailing-list
- [zookeeper-issues] 20210924 [jira] [Resolved] (ZOOKEEPER-4385) Backport ZOOKEEPER-4278 to branch-3.5 to Address CVE-2021-21409 mailing-list
- [zookeeper-commits] 20210924 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-4385. Backport ZOOKEEPER-4278 to branch-3.5 to Address CVE-2021-21409 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- [pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html