CVE-2026-59900: netty HTTP Request/Response Smuggling

CVSS: 6.9v4.0MediumAnalyzed

AliasesUBUNTU-CVE-2026-59900DEBIAN-CVE-2026-59900CGA-2534-w9hh-527j+658 more

Published 29-07-2026Last modified 29-07-2026

Vulnerability summary

CVE-2026-59900 is a medium (CVSS 6.9) HTTP Request/Response Smuggling vulnerability in netty. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.40%

0%100%

Low · +0.17 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:11394-1 SUSE-SU-2026:3482-1 CGA-F267-869R-XG8P

Timeline

29-07-2026
PublishedVulnerability first disclosed.
29-07-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS metrics

9 scores · 7 sources · 2 versions

v4.06.9v3.15.3

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

+0.17 pp

From 0.23% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Chainguard200 products

airbyte-server< 2.0.0-r8
airbyte-server-fips< 2.0.0-r10
akhq< 0.27.1-r14
apache-camel-karavan-devmode< 4.18.1-r8
apache-hop< 2.18.1-r13

apache-hop-fips< 2.18.1-r6
apache-nifi< 2.10.0-r7
apache-pulsar-4.0< 4.0.12-r2
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.3-r3
apache-pulsar-fips-4.0< 4.0.12-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.3-r2
apicurio-registry< 3.3.0-r11
apicurio-registry-3-operator< 3.3.0-r11
apicurio-registry-3-operator-fips< 3.3.0-r8
apicurio-registry-fips< 3.3.0-r8
camunda-8.8< 8.8.31-r2
camunda-8.9< 8.9.13-r2
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.35-r1
camunda-zeebe-8.8< 8.8.32-r1
camunda-zeebe-8.9< 8.9.13-r1
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r32
celeborn-0.6< 0.6.3-r13 | All versions (No fix recorded)
celeborn-0.7< 0.7.0-r6 | < 0.7.0-r3
cloudwatch-exporter< 0.18.0-r1 | < 0.18.0-r5
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.22-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
conductor< 3.31.0-r5
conductor-fips< 3.31.0-r6
druid< 37.0.0-r47 | < 37.0.0-r56 | < 37.0.0-r46
elasticsearch-8.19< 8.19.19-r1
elasticsearch-8.19-iamguarded< 8.19.19-r1
elasticsearch-8.19-iamguarded-fips< 8.19.19-r1
elasticsearch-9.1< 9.1.10-r9
elasticsearch-9.1-iamguarded< 9.1.10-r9
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2< 9.2.8-r8
elasticsearch-9.2-iamguarded< 9.2.8-r8
elasticsearch-9.2-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.3All versions (No fix recorded)
elasticsearch-9.3-iamguarded< 9.3.8-r6
elasticsearch-9.3-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.4< 9.4.5-r4
elasticsearch-9.4-iamguarded< 9.4.5-r3
elasticsearch-9.4-iamguarded-fips< 9.4.5-r5
elasticsearch-9.5< 9.5.1-r3
elasticsearch-9.5-iamguarded< 9.5.1-r3
elasticsearch-9.5-iamguarded-fips< 9.5.2-r3
elasticsearch-fips-8.19< 8.19.19-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2All versions (No fix recorded)
elasticsearch-fips-9.3All versions (No fix recorded)
elasticsearch-fips-9.4< 9.4.5-r5
elasticsearch-fips-9.5< 9.5.2-r3
floci< 1.5.33-r6
floci-az< 0.9.0-r3
flyway< 13.0.0-r1
flyway-fips< 13.0.0-r3
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r7
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r14 | < 3.5.0-r3 | All versions (No fix recorded)
hono-adapter-mqtt< 2.7.0-r33 | < 2.7.0-r32
hono-cli< 2.7.0-r33 | < 2.7.0-r32
hono-service-auth< 2.7.0-r32
hono-service-command-router< 2.7.0-r32
hono-service-device-registry-jdbc< 2.7.0-r33 | < 2.7.0-r32
infinispan-15.0< 15.0.22-r14
infinispan-15.1< 15.1.7-r25
infinispan-15.2< 15.2.6-r23
infinispan-16.0< 16.0.14-r2
infinispan-16.1< 16.1.4-r7
infinispan-16.2< 16.2.1-r2
kafbat-ui< 1.5.0-r10
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-bridge< 1.0.0-r9
kafka-bridge-fips< 1.0.0-r6
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.6-r11
kayenta-2026.0< 2026.0.4-r17
kayenta-2026.1< 2026.1.2-r1
kayenta-fips-2025.2< 2025.2.4-r7
kayenta-fips-2025.4< 2025.4.6-r6
kayenta-fips-2026.0< 2026.0.4-r11
kayenta-fips-2026.1< 2026.1.2-r1
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.4-r21
keycloak-26.6-iamguarded-compat< 26.6.4-r21
keycloak-26.6-operator< 26.6.4-r21
keycloak-26.7< 26.7.0-r7
keycloak-26.7-iamguarded-compat< 26.7.0-r7
keycloak-26.7-operator< 26.7.0-r7
keycloak-fips-26.5< 26.5.7-r6
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r6
keycloak-fips-26.5-operator< 26.5.7-r6
keycloak-fips-26.6< 26.6.4-r6
keycloak-fips-26.6-iamguarded-fips< 26.6.4-r6
keycloak-fips-26.6-operator< 26.6.4-r6
keycloak-fips-26.7< 26.7.0-r5 | < 26.7.0-r4
keycloak-fips-26.7-iamguarded-fips< 26.7.0-r4 | < 26.7.0-r5
keycloak-fips-26.7-operator< 26.7.0-r4 | < 26.7.0-r5
knative-kafka-broker-1.20-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.20-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r14
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r14
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r3
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r3
knative-kafka-broker-fips-1.20-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.20-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.4-r9
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.4-r9
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.2-r12
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.2-r12
kserve-modelmesh< 0.12.0-r38
localstack< 4.14.0-r20
management-api-for-apache-cassandra-5.0< 0.1.122-r2
metabase< 0.63.2-r3
neo4j-2025.12< 2025.12.1-r6
neo4j-2026.01< 2026.01.4-r6
neo4j-2026.02< 2026.02.3-r3
opensearch-2-ml-commons< 2.19.6-r6
opensearch-2-performance-analyzer< 2.19.6-r6
opensearch-2-repository-azure< 2.19.6-r6
opensearch-2-repository-s3< 2.19.6-r6
opensearch-3< 3.7.0-r5
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-ml-commons< 3.7.0-r5
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.7.0-r5
opensearch-3-performance-analyzer< 3.7.0-r5
opensearch-3-repository-azure< 3.7.0-r5
opensearch-3-repository-s3< 3.7.0-r5
opensearch-3-security< 3.7.0-r5
opensearch-3-security-analytics< 3.8.0-r2
opensearch-fips-3< 3.7.0-r5
opensearch-fips-3-ml-commons< 3.7.0-r5
opensearch-fips-3-notifications< 3.7.0-r5
opensearch-fips-3-performance-analyzer< 3.7.0-r5
opensearch-fips-3-repository-azure< 3.7.0-r5
opensearch-fips-3-repository-s3< 3.7.0-r5
opensearch-fips-3-security< 3.7.0-r5
opensearch-fips-3-security-analytics< 3.8.0-r2
pinot< 1.5.1-r8
pinot-fips< 1.5.1-r6
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r7
request-9047-keycloak-fips-26.4< 26.4.7-r27
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r27
request-9047-keycloak-fips-26.4-operator< 26.4.7-r27
request-9047-keycloak-fips-26.5< 26.5.7-r17
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r17
request-9047-keycloak-fips-26.5-operator< 26.5.7-r17
request-9047-keycloak-fips-26.6< 26.6.4-r9
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r9
request-9047-keycloak-fips-26.6-operator< 26.6.4-r9
s3proxy< 3.3.0-r7
s3proxy-fips< 3.3.0-r6
seata-server< 2.7.0-r3
sonarqube< 26.9.0.129388-r4
spark-3.5-scala-2.12< 3.5.9-r2
spark-3.5-scala-2.13< 3.5.9-r2
spark-4.0-scala-2.13< 4.0.4-r1
spark-4.1-scala-2.13< 4.1.3-r2
spark-4.2-scala-2.13< 4.2.0-r3
spark-fips-3.5-scala-2.12< 3.5.8-r6
spark-fips-3.5-scala-2.13< 3.5.8-r6
spark-fips-4.1-scala-2.13< 4.1.2-r6
spark-fips-4.2-scala-2.13< 4.2.0-r3
spark-kubernetes-operator< 0.9.0-r6
spark-kubernetes-operator-fips< 1.0.0-r0
strimzi-kafka-operator< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-cluster-operator< 1.2.0-r5 | < 1.2.0-r4 | < 1.1.0-r4
strimzi-kafka-operator-fips-cluster-operator< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-agent< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-init< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.1.0-r1
strimzi-kafka-operator-fips-topic-operator< 1.1.0-r1
strimzi-kafka-operator-fips-tracing-agent< 1.1.0-r1
strimzi-kafka-operator-fips-user-operator< 1.1.0-r1
strimzi-kafka-operator-kafka-agentAll versions (No fix recorded) | < 1.2.0-r5 | < 1.1.0-r4
strimzi-kafka-operator-kafka-base< 1.2.0-r5
strimzi-kafka-operator-kafka-initAll versions (No fix recorded) | < 1.2.0-r5 | < 1.1.0-r4 | < 1.2.0-r4
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 1.1.0-r4
strimzi-kafka-operator-topic-operator< 1.2.0-r5 | < 1.2.0-r4 | < 1.1.0-r4
strimzi-kafka-operator-tracing-agent< 1.1.0-r4 | < 1.2.0-r5

Show all 200

1 vendor · 200 products · Showing 200 of 271. Use Open JSON for the complete list.

References

9 links

github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqjX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/netty/netty/releases/tag/netty-4.1.136.FinalX Refsource MISCWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.16.FinalX Refsource MISCWEBRelease Notes
ubuntu.com/security/CVE-2026-59900REPORT
www.cve.org/CVERecord?id=CVE-2026-59900REPORT
security-tracker.debian.org/tracker/CVE-2026-59900Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59900.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-59900Advisory
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities