CVE-2026-59900: Netty HTTP/2 Host Header Vulnerability

CVE-2026-59900 Overview

CVE-2026-59900 is an HTTP request smuggling vulnerability [CWE-444] in Netty, an asynchronous, event-driven network application framework. The flaw resides in Netty's HTTP/2-to-HTTP/1.x translation layer, specifically the Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter components. These translators fail to deduplicate or validate Host headers when an HTTP/2 client sends both the :authority pseudo-header and a literal host header in a single HEADERS frame. The result is an HttpRequest object with two conflicting Host header values controlled by the attacker. Netty maintainers fixed the issue in versions 4.1.136.Final and 4.2.16.Final.

Critical Impact
Attackers can inject conflicting Host headers into downstream HTTP/1.x traffic, enabling request routing confusion and cache poisoning against upstream services.

Affected Products

Netty versions prior to 4.1.136.Final
Netty versions prior to 4.2.16.Final
Applications using Http2StreamFrameToHttpObjectCodec or InboundHttp2ToHttpAdapter

Discovery Timeline

2026-07-29 - CVE-2026-59900 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-59900

Vulnerability Analysis

The vulnerability is a classic HTTP request smuggling weakness caused by inconsistent header parsing between protocol layers. HTTP/2 uses the :authority pseudo-header to identify the target host, while HTTP/1.x uses the Host header. When Netty translates HTTP/2 requests into HTTP/1.x request objects, it maps :authority to Host and then separately copies any literal host header present in the HTTP/2 HEADERS frame. Netty does not detect that both values now populate the same header field. Downstream code, proxies, or backend servers see two Host header values and may select different values than the front-end proxy chose. This mismatch enables request routing confusion and can be chained into cache poisoning or access-control bypass against virtual-hosted backends.

Root Cause

The root cause is missing deduplication and validation logic in the HTTP/2-to-HTTP/1.x translation code paths. Netty trusts that clients will send either :authority or Host, but not both. The translator concatenates the results without conflict detection, violating the requirement that HTTP/1.x messages contain exactly one Host header.

Attack Vector

An attacker sends a crafted HTTP/2 HEADERS frame that includes an :authority pseudo-header set to a legitimate value and a literal host header set to an attacker-chosen value. When the frame passes through a Netty-based gateway, proxy, or application server, the resulting HttpRequest object contains both header values. If the request is forwarded downstream over HTTP/1.x, or if downstream logic uses the second Host value for routing or authorization, the attacker can direct traffic to unintended virtual hosts. Full technical details are available in the GitHub Security Advisory GHSA-c69g-56f8-xwqj.

Detection Methods for CVE-2026-59900

Indicators of Compromise

HTTP/2 requests containing both an :authority pseudo-header and a literal host header with differing values.
Backend access logs showing Host header values that do not match the front-end proxy's expected virtual host.
HTTP/1.x downstream traffic emitted by Netty containing two Host headers in the same request.

Detection Strategies

Inspect HTTP/2 HEADERS frames at ingress and flag frames that carry both :authority and host fields.
Compare Host header values between the front-end gateway and backend application logs to identify smuggling attempts.
Deploy web application firewall rules that reject HTTP/1.x requests containing more than one Host header.

Monitoring Recommendations

Enable verbose HTTP/2 frame logging on Netty-based services during the vulnerability window and audit for header duplication.
Track the version of Netty deployed across microservices and alert on any instance running below 4.1.136.Final or 4.2.16.Final.
Correlate anomalous virtual-host routing events with upstream client IPs to identify potential exploitation attempts.

How to Mitigate CVE-2026-59900

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final on all services that use the HTTP/2-to-HTTP/1.x codecs.
Inventory all applications and frameworks that embed Netty transitively, including Spring, gRPC, and reactive stacks.
Enforce single-Host-header validation at any reverse proxy sitting in front of Netty-based services.

Patch Information

Netty maintainers released fixes in netty-4.1.136.Final and netty-4.2.16.Final. The patched translators now detect and reject HTTP/2 requests that supply both :authority and a literal host header with conflicting values.

Workarounds

Add a custom ChannelHandler upstream of Http2StreamFrameToHttpObjectCodec that rejects frames containing both :authority and host headers.
Configure edge proxies to strip literal host headers from inbound HTTP/2 requests before forwarding to Netty backends.
Enable strict HTTP/1.x compliance checks on downstream servers so that requests with duplicate Host headers are rejected.

bash

# Configuration example: verify installed Netty version via Maven
mvn dependency:tree | grep io.netty

# Upgrade example in Maven pom.xml
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-codec-http2</artifactId>
#   <version>4.1.136.Final</version>
# </dependency>