CVE-2026-59900
Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
How to fix
- netty netty4.1.136, 4.2.16 or later
- io.netty:netty-codec-http24.2.16.Final, 4.1.136.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.136, 4.2.0 ≤ v < 4.2.16 | 4.1.136, 4.2.16 |
| io.netty:netty-codec-http2Maven | 4.2.0.Final ≤ v < 4.2.16.Final, v < 4.1.136.Final | 4.2.16.Final, 4.1.136.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.