CVE-2026-59900

Analyzed Analyzed - Analysis Complete

HTTP/2 Host Header Duplication in Netty

Publication date: 2026-07-29

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-06

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-59900

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

Netty is a network framework with a flaw in its HTTP/2-to-HTTP/1.x translation layer. When an HTTP/2 client sends both the :authority pseudo-header and a literal host header in one frame, the system fails to remove duplicate or validate the host headers. This results in an HttpRequest object containing two conflicting Host headers controlled by an attacker.

Detection Guidance

Detecting this vulnerability requires inspecting HTTP/2 traffic for duplicate or conflicting Host headers. Use tools like Wireshark or tcpdump to capture and analyze HTTP/2 frames. Look for HEADERS frames containing both :authority pseudo-header and a literal host header with differing values. Check server logs for malformed requests or errors related to header processing.

Impact Analysis

An attacker could exploit this to send requests with conflicting Host headers, potentially bypassing security controls, redirecting traffic, or manipulating server responses. This may lead to unauthorized access, data leaks, or service disruption if the server processes the malformed requests.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage due to insufficient security controls.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later for 4.1.x users, or 4.2.16.Final or later for 4.2.x users. If upgrading is not immediately possible, disable HTTP/2 support or implement a network-level filter to block malformed requests with duplicate Host headers. Monitor for exploitation attempts in logs.

Hi! I’m here to help you understand CVE-2026-59900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70