Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- io.netty/netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported
- netty-codec-http2
Version range not reported