Medium [CVE-2026-59900] Improper header neutralization in netty-codec-http2
This medium-severity Red Hat Linux advisory covers CVE-2026-59900 affecting Red Hat build of Quarkus 3.27.4.SP3, Red Hat build of Quarkus 3.33.2.SP3, Cryostat 4.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Netty is an asynchronous, event-driven network application framework.
Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame.
The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. A flaw was found in Netty's netty-codec-http2 component.
The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks.
Such attacks can enable an attacker to manipulate web content or inject malicious headers. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
Weakness: CWE-113.
Affected products named by the advisory: Red Hat build of Quarkus 3.27.4.SP3; Red Hat build of Quarkus 3.33.2.SP3; Cryostat 4; OpenShift Serverless; and 16 more.
- < 4.1.136.Final
- < 4.2.16.Final
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
- 4.1.136
- 4.2.16
- netty-codec-http2
- RHSA-2026:47189
- RHSA-2026:47172
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- - Upgrade `netty-codec-http2` to version 4.1.136.Final (4.1.x branch) or 4.2.16.Final (4.2.x branch). - If upgrading is not immediately possible, ensure that HTTP/2 traffic is routed through a reverse proxy or WAF that validates and sanitizes HTTP headers before forwarding to the Netty-based application.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.