Netty prior 4.1.136.Final/4.2.16.Final Http2StreamFrameToHttpObjectCodec improper synchronization

Summaryinfo

A vulnerability was found in Netty and classified as critical. This issue affects some unknown processing of the component Http2StreamFrameToHttpObjectCodec/InboundHttp2ToHttpAdapter. The manipulation results in improper synchronization. This vulnerability is cataloged as CVE-2026-59900. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Netty. It has been classified as critical. Affected is an unknown code of the component Http2StreamFrameToHttpObjectCodec/InboundHttp2ToHttpAdapter. The manipulation with an unknown input leads to a improper synchronization vulnerability. CWE is classifying the issue as CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-59900 since 07/07/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

Upgrading to version 4.1.136.Final or 4.2.16.Final eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Netty

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion