CVE-2021-43797: Netty HTTP Request Smuggling Vulnerability

CVE-2021-43797 Overview

CVE-2021-43797 is an HTTP request smuggling vulnerability in Netty, an asynchronous event-driven network application framework used to build high-performance protocol servers and clients. Versions prior to 4.1.71.Final silently strip control characters from the beginning or end of HTTP header names instead of rejecting them. The Hypertext Transfer Protocol (HTTP) specification prohibits these characters, and Netty's permissive handling enables request smuggling when it sits in front of another HTTP system. The flaw is tracked as [CWE-444] Inconsistent Interpretation of HTTP Requests. Maintainers fixed the issue in 4.1.71.Final.

Critical Impact
A network-based attacker can craft HTTP headers containing control characters that Netty sanitizes and forwards to a downstream server, enabling HTTP request smuggling, cache poisoning, and bypass of front-end security controls.

Affected Products

Netty prior to 4.1.71.Final
Quarkus, Oracle Coherence, Oracle Helidon, Oracle PeopleSoft Enterprise PeopleTools, multiple Oracle Communications Cloud Native Core components, Oracle Banking products
NetApp OnCommand Workflow Automation, NetApp SnapCenter, Debian Linux 10 and 11

Discovery Timeline

2021-12-09 - CVE-2021-43797 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43797

Vulnerability Analysis

Netty's HTTP decoder normalizes header names before passing requests to downstream handlers or proxied backends. When a header name begins or ends with ASCII control characters, Netty trims them rather than failing the request. The HTTP/1.1 specification (RFC 7230) defines header field names as tokens that exclude control characters, so a compliant parser must reject such input.

When Netty acts as a reverse proxy or front-end gateway, this sanitization hides protocol violations from the upstream server. The two HTTP parsers then disagree on which bytes constitute a valid header, which is the root condition for HTTP request smuggling. An attacker can exploit this disagreement to inject a second request that bypasses front-end access control, poison shared caches, or hijack responses intended for other users.

Root Cause

The root cause is improper input validation in Netty's HTTP header parser. The parser skipped leading and trailing control characters in header names rather than rejecting the malformed input. This silent normalization violates the fail-fast principle required by [CWE-444] and produces a parsing differential between Netty and any peer HTTP implementation.

Attack Vector

Exploitation requires the attacker to send HTTP traffic to a Netty-fronted service that forwards requests to a second HTTP parser. The attacker crafts a request with a header name prefixed or suffixed by control bytes, for example a Transfer-Encoding or Content-Length header. Netty strips the control characters and forwards a now-valid-looking header, while the backend would have rejected or interpreted the original bytes differently. The desynchronization enables request smuggling without authentication and without user interaction beyond normal HTTP traffic.

The fix in commit 07aa6b5938a8b6ed7a6586e066400e2643897323 replaces the trimming logic with strict validation that rejects any header name containing control characters. See the GitHub Security Advisory GHSA-wx5j-54mm-rqqq for the maintainer's technical write-up.

Detection Methods for CVE-2021-43797

Indicators of Compromise

HTTP requests containing control characters (bytes 0x00-0x1F or 0x7F) adjacent to header names captured at the network edge or in proxy access logs
Duplicate or conflicting Content-Length and Transfer-Encoding headers in traffic traversing Netty-based proxies
Unexpected backend responses that do not align with the request the front-end logged, indicating possible desynchronization

Detection Strategies

Inventory Java services and identify any deployment bundling netty-codec-http versions earlier than 4.1.71.Final, including transitive dependencies inside Quarkus, Oracle, and NetApp products
Inspect HTTP traffic with an intrusion detection system (IDS) or web application firewall (WAF) rule that flags non-token characters in header field names
Run software composition analysis (SCA) against build artifacts and container images to surface vulnerable Netty coordinates

Monitoring Recommendations

Forward proxy and application logs to a centralized analytics platform and alert on requests where header names contain non-printable bytes
Correlate front-end and backend access logs to identify request count or response mismatches indicative of smuggling
Track outbound advisories from vendors listed in this CVE, including Oracle Critical Patch Updates and NetApp security bulletins, for product-specific fixed versions

How to Mitigate CVE-2021-43797

Immediate Actions Required

Upgrade Netty to 4.1.71.Final or later in all applications, libraries, and container images
Apply vendor patches for downstream products including Quarkus, Oracle Coherence, Oracle Helidon, Oracle PeopleSoft, Oracle Communications components, NetApp OnCommand Workflow Automation, and NetApp SnapCenter
Update Debian 10 and Debian 11 packages per the Debian Security Notice DSA-5316 and the Debian LTS announcement

Patch Information

The upstream fix is published in Netty commit 07aa6b5 and shipped in 4.1.71.Final. Oracle distributed product-specific fixes in the April 2022 Critical Patch Update and the July 2022 Critical Patch Update. NetApp published remediation guidance in the NetApp Security Advisory NTAP-20220107-0003.

Workarounds

Place a strict HTTP parser or WAF in front of Netty-based services to reject requests with control characters in header names before they reach the vulnerable decoder
Disable HTTP keep-alive and connection reuse between front-end proxies and Netty backends where feasible, reducing the smuggling attack surface until patching is complete
Restrict Netty-fronted services to clients that cannot inject raw HTTP, for example by terminating TLS at a validated reverse proxy that normalizes headers conservatively

bash

# Verify the Netty version in a Maven project and update the dependency
mvn dependency:tree | grep netty

# Maven coordinate for the fixed release
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-all</artifactId>
#   <version>4.1.71.Final</version>
# </dependency>