← Browse

CVE-2026-59900

Low

No strong exploitation signal.

CVSS base
5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS — probability of exploitation (30 days)
0.2%
14.4th percentile
CISA KEV
Not listed
Weakness / dates
CWE-444
Published 2026-07-29 · modified 2026-08-06

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack VectorNNetwork
Attack ComplexityLLow
Privileges RequiredNNone
User InteractionNNone
ScopeUUnchanged
ConfidentialityNNone
IntegrityLLow
AvailabilityNNone

Timeline

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected

netty

References

Official: NVD · CVE.org