CVE-2021-43797

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

• CWE-444
• CWE-444

• https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323Patch, Third Party Advisory
• https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqqThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220107-0003/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5316Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323Patch, Third Party Advisory
• https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqqThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220107-0003/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5316Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Dec 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43790Lucet is a native WebAssembly compiler and runtime. There is…8.1
• CVE-2021-43791Zulip is an open source group chat application that combines…5.3
• CVE-2021-43792Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43793Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43794Discourse is an open source discussion platform. In affected…5.3
• CVE-2021-43795Armeria is an open source microservice framework. In affecte…7.5
• CVE-2021-43798Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-4380The Pinterest Automatic plugin for WordPress is vulnerable t…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5
• CVE-2021-43802Etherpad is a real-time collaborative editor. In versions pr…8.8