Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-hzxz-sqmu-s7e1
|
Possible request smuggling in HTTP/2 due missing validation of content-length
### Impact
The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1
This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case.
### Patches
This was fixed as part of 4.1.61.Final
### Workarounds
Validation can be done by the user before proxy the request by validating the header.
|
CVE-2021-21409
GHSA-f256-j965-7f32
|