CVE-2026-59900

About vulnerability

Netty’s HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps :authority to Host and separately copies the literal host header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values.

Affected product:

Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Hazelcast , Netty , OpenSearch , Spring , Wildfly , alluxio , amazon-dynamodb-lock-client , amazon-kinesis-client , amazon-kinesis-producer , amqp-10-jms-spring-boot , appintegrations , applicationinsights-java , arrow , artemis , async-http-client , athenz , avro , aws-glue-schema-registry , aws-lakeformation-accessgrants-plugin-java-v2 , aws-s3-accessgrants-plugin-java-v2 , aws-sdk-java , aws-sdk-java-v2 , azure-kusto-java , azure-sdk-for-java , azure-search-documents , azure-spring-data-cosmos , bolt-connection-java , bookkeeper , camel , cassandra-java-driver , chatbot , corda , corda-api , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , debezium , docker-java , etcd4j , finspace , flink , flink-shaded , flume , google-cloud-java , googleapis , grpc-java , hbase , hbase-thirdparty , http-client , ignite , infinispan , io.quarkus:quarkus-credentials-deployment , io.quarkus:quarkus-datasource-deployment-spi , io.quarkus:quarkus-resteasy , ivschat , jaeger-analytics-java , java-datastore , java-driver , java-logging , jena , jersey , jetcd , kinesis-logback-appender , lettuce , licensemanagerusersubscriptions , logging-flume , logging-flume-irc , metrics , micrometer , micronaut-core , neo4j , neo4j-java-driver , neo4j-ogm , olingo-odata4 , opencensus-java , org.apache.ratis:ratis-thirdparty-misc , partnercentralaccount , pgjdbc-ng , pinecone-java-client , pravega , pulsar , pulsar-client-reactive , qpid-jms , quarkus , rabbitmq-java-client , rabbitmq-stream-java-client , ratis , redisson , rsocket-java , sdk-platform-java , smallrye-common , smallrye-fault-tolerance , smallrye-mutiny-vertx-bindings , smallrye-reactive-messaging , software.amazon.awssdk:applicationcostprofiler , software.amazon.awssdk:apptest , software.amazon.awssdk:bcmpricingcalculator , software.amazon.awssdk:cleanroomsml , software.amazon.awssdk:evs , software.amazon.awssdk:iotdeviceadvisor , software.amazon.awssdk:odb , software.amazon.awssdk:rbin , software.amazon.awssdk:wickr , strimzi-kafka-operator , synthetics , tika , tinkerpop , vert.x , vertx-auth , vertx-eventbus-bridges , vertx-grpc , vertx-kafka-client , vertx-web , voiceid , zendesk-java-client , zookeeper

Affected packages:

Spring Boot @ 2.7.18 (+23874 more)