VulnSocial

CVE-2026-59900Disclosure(netty / netty)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

netty CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-444

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • netty

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-29); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
netty
Products
netty

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-29: 2Mentions · 2026-08-08: 1Technical Details · 2026-07-29: 1Technical Details · 2026-08-08: 107-2908-08
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-07-292
Disclosure1General1
2026-08-081
Disclosure1
Full discourse3 posts
  • DailyCVE@dailycve
    Disclosure

    🟠 Netty (codec-http2) - Host Header Deduplication Failure in HTTP/2→HTTP/1x Translation - #CVE-2026-59900 (Medium) -DC-Aug2026-1463 https://dailycve.com/netty-codec-http2-host-header-deduplication-failure-in-http-2%e2%86%92http-1x-translation-cve-2026-59900-medium-dc-aug2026-1463/

    Post summary

    A new CVE (CVE‑2026‑59900) has been disclosed for Netty’s codec‑http2 module, describing a host header deduplication failure during HTTP/2‑to‑HTTP/1.x translation. No PoC, exploit, or patch information is provided.

    0000159
    226 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-59900 Netty is an asynchronous, event-driven network application framework. Prior to versions http://4.1.136.Final and http://4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (… https://www.cve.org/CVERecord?id=CVE-2026-59900 ----- Traducció… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-59900, a vulnerability in Netty’s HTTP/2-to-HTTP/1.x translation layer affecting versions prior to 4.1.136.Final and 4.2.16.Final.

    0000029
    96 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-59900 Netty is an asynchronous, event-driven network application framework. Prior to versions http://4.1.136.Final and http://4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (… https://www.cve.org/CVERecord?id=CVE-2026-59900

    Post summary

    The post identifies a vulnerability in Netty’s HTTP/2‑to‑HTTP/1.x translation layer and points to vulnerable versions, but offers no exploitation details, PoC, or patch information, classifying it as a general mention.

    00000697
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnettynetty---

Explore more

Back to dashboardnetty CVEsnetty vulnerabilities