CVE-2021-21409

Published: Mar 30, 2021Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

Affected (28)

Products: Netty: Netty · Debian: Debian Linux · Netapp: Oncommand Api Services, Oncommand Workflow Automation · +2 more

Show all products

1 product

1 product

2 products

Oncommand Api Services

Oncommand Workflow Automation

Oracle

13 products

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Trade Finance Process Management

Coherence

Communications Brm Elastic Charging Engine

Communications Cloud Native Core Console

Communications Cloud Native Core Policy

Communications Design Studio

Communications Messaging Server

Helidon

Jd Edwards Enterpriseone Tools

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netty Netty	Before 4.1.61

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Api Services	All versions
Netapp Oncommand Workflow Automation	All versions

Configuration D

23 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Corporate Lending Process Management	Version 14.2.0
Oracle Banking Corporate Lending Process Management	Version 14.3.0
Oracle Banking Corporate Lending Process Management	Version 14.5.0
Oracle Banking Credit Facilities Process Management	Version 14.2.0
Oracle Banking Credit Facilities Process Management	Version 14.3.0
Oracle Banking Credit Facilities Process Management	Version 14.5.0
Oracle Banking Trade Finance Process Management	Version 14.2.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.5.0
Oracle Coherence	Version 12.2.1.4.0
Oracle Coherence	Version 14.1.1.0.0
Oracle Communications Brm Elastic Charging Engine	Version 12.0.0.3
Oracle Communications Cloud Native Core Console	Version 1.7.0
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Design Studio	Version 7.4.2.0.0
Oracle Communications Messaging Server	Version 8.1
Oracle Helidon	Version 1.4.10
Oracle Helidon	Version 2.4.0
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.3
Oracle Nosql Database	Before 21.1.12
Oracle Primavera Gateway	From 17.12.0 to 17.12.11
Oracle Primavera Gateway	From 18.8.0 to 18.8.11
Oracle Primavera Gateway	From 19.12.0 to 19.12.10

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Quarkus Quarkus	Up to 1.13.7

Related CWEs

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.