HTTP Request Smuggling Affecting io.netty:netty-codec-http2 package, versions [,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IONETTY-18233111
- published23 Jul 2026
- disclosed22 Jul 2026
- creditUnknown
Introduced: 22 Jul 2026
NewCVE-2026-59900 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade io.netty:netty-codec-http2 to version 4.1.136.Final, 4.2.16.Final or higher.
Overview
io.netty:netty-codec-http2 is a HTTP2 sub package for the netty library, an event-driven asynchronous network application framework.
Affected versions of this package are vulnerable to HTTP Request Smuggling in the translation from HTTP/2 to HTTP/1.x, specifically when handling both the :authority pseudo-header and a literal host header in a single HEADERS frame. An attacker can manipulate request routing by supplying differing values for these headers, resulting in two Host headers in the resulting request object.