VDB
RHSA-2021%3A2465
RHSA-2021%3A2465
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The highest threat from this vulnerability is to integrity.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Vert.x 4.1.0 |
Timeline
- Jul 7, 2021 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2021:2465 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=4.1.0 advisory
- https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.1/html/release_notes_for_eclipse_vert.x_4.1/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1944888 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1948752 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2465.json advisory
- https://access.redhat.com/security/cve/CVE-2021-21409 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-21409 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-21409 advisory
- https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32 advisory
- https://access.redhat.com/security/cve/CVE-2021-29425 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-29425 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-29425 advisory