Listen to this Post
How CVE-2026-59900 Works
Netty is an asynchronous, event-driven network application framework widely used in Java-based microservices, API gateways, and reverse proxies. The vulnerability resides in Netty’s HTTP/2-to-HTTP/1.x translation layer, specifically within the `Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter` components. These components are responsible for converting HTTP/2 HEADERS frames into HTTP/1.x `HttpRequest` objects for downstream processing.
When an HTTP/2 client sends a single HEADERS frame containing both the `:authority` pseudo-header and a literal `host` header, Netty’s translation logic performs two separate operations. First, it maps the `:authority` pseudo-header to a `Host` header in the resulting HTTP/1.x request. Second, it independently copies the literal `host` header as an additional `Host` header field. The framework fails to deduplicate or validate these headers, producing an `HttpRequest` object that contains two `Host` headers with potentially different, attacker-controlled values.
This flaw enables HTTP request/response smuggling attacks (CWE-444). Downstream systems such as web servers, reverse proxies, and load balancers handle duplicate headers inconsistently—some take the first value, others the last, and some combine them unpredictably. An attacker can exploit this ambiguity to manipulate request routing, bypass access controls, poison caches, or trigger application logic errors.
The vulnerability affects all Netty versions prior to 4.1.136.Final and 4.2.16.Final. The fix, implemented in these releases, ensures proper deduplication and validation of `Host` headers during HTTP/2 to HTTP/1.x translation.
DailyCVE Form:
Platform: ……. Netty
Version: …….. <4.1.136.Final, <4.2.16.Final
Vulnerability :…… Host Header Deduplication Failure
Severity: ……. 6.9 MEDIUM (CVSS 4.0)
date: ………. 2026-07-29
Prediction: …… Patch available 2026-07-29
What Undercode Say:
Analytics
Check Netty version in Maven project mvn dependency:tree | grep netty-codec-http2 Check for vulnerable versions Affected: <4.1.136.Final and <4.2.16.Final Fixed: 4.1.136.Final and 4.2.16.Final Remediation commands mvn versions:update-property -Dproperty=netty.version -DnewVersion=4.1.136.Final mvn versions:update-property -Dproperty=netty.version -DnewVersion=4.2.16.Final
Exploit:
Crafted HTTP/2 HEADERS frame with conflicting headers :method = GET :path = /admin :authority = legit.example.com host = attacker-controlled.com Resulting HttpRequest contains TWO Host headers: Host: legit.example.com Host: attacker-controlled.com Downstream server ambiguity leads to routing bypass
Protection:
- Upgrade to Netty 4.1.136.Final or 4.2.16.Final immediately
- If unable to upgrade, deploy a reverse proxy that normalizes/deduplicates Host headers before reaching Netty
- Implement input validation on the `Host` header in application code
- Monitor for HTTP/2 HEADERS frames containing both `:authority` and literal `host` headers
Impact:
- Request Routing Bypass: Attackers can force requests to be routed to unintended backend services
- Cache Poisoning: Duplicate Host headers can poison reverse proxy caches
- Access Control Evasion: Security controls relying on Host header validation can be bypassed
- Application Logic Errors: Downstream systems may behave unpredictably when processing duplicate headers
- Wide Attack Surface: Affects all applications using Netty for HTTP/2 to HTTP/1.x translation
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
