CVE-2026-59900

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description The HTTP/2-to-HTTP/1.x translation layer, specifically within Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter, fails to deduplicate or validate Host headers. When an HTTP/2 client provides both the :authority pseudo-header and a literal host header in a single HEADERS frame, the translator maps :authority to Host while also copying the literal host header. This results in an HttpRequest object containing two Host headers with differing values controlled by an attacker.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.