CVE-2026-59900Medium▾ SunlitNetty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
Netty's HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps :authority to Host and separately copies the literal host header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values.
io.netty:netty-codec-http2 >= 4.2.0.Final, <= 4.2.15.Finalio.netty:netty-codec-http2 < 4.1.136.FinalUpgrade to a patched release:
io.netty:netty-codec-http2 4.2.16.Finalio.netty:netty-codec-http2 4.1.136.FinalConnected by shared product, vendor, weakness, or advisory.
CVE-2026-59898MediumNetty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
GHSA-mfg7-5gfp-c4w3Medium· 5.3Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
GHSA-v74w-7mr3-4qg3High· 7.5Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
CVE-2026-56821High· 7.4Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
CVE-2026-56822High· 7.4Netty: TOCTOU in OcspServerCertificateValidator
CVE-2026-59919Medium· 5.5Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address