Severity
6.9
Medium severity
Details
- CVSS score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
Netty’s HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps :authority to Host and separately copies the literal host header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values.
Details
- Affected product:
- Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Netty , Spring , Wildfly , alluxio , amazon-kinesis-client , amqp-10-jms-spring-boot , artemis , async-http-client , avro , aws-sdk-java , aws-sdk-java-v2 , azure-sdk-for-java , azure-search-documents , bolt-connection-java , bookkeeper , bookkeeper-common-allocator , camel , cassandra-java-driver , corda , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , distributedlog , flink , flink-shaded , flume , googleapis , grpc-java , hbase , hbase-thirdparty , infinispan , jaeger-analytics-java , java-datastore , java-driver , jersey , lettuce , logging-flume , metrics , micrometer , micronaut-core , neo4j-java-driver , neo4j-ogm , olingo-odata4 , pinecone-java-client , pulsar , qpid-jms , rabbitmq-java-client , rabbitmq-stream-java-client , redisson , rsocket-java , sdk-platform-java , tika , vert.x , zookeeper
- Affected packages:
- netty-transport-native-unix-common @ 4.1.86.Final (+13470 more)