{"id":"CVE-2026-59900","title":"io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2 (CVE-2026-59900)","summary":"A flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP respons…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","cvssSource":"vendor","cwe":["CWE-113","CWE-444"],"vendor":"Red Hat","product":"OpenShift Serverless","affected":["cryostat 4","openshift_serverless","amq_broker 7","build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apache_camel_for_spring_boot 4","build_of_apicurio_registry 3","build_of_debezium 3","build_of_keycloak","build_of_quarkus","data_grid 8","enterprise_linux_ai_rhel_ai 3","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform_expansion_pack","openshift_ai_rhoai","openshift_dev_spaces","single_sign_on 7","streams_for_apache_kafka 2","streams_for_apache_kafka 3","build_of_quarkus 3.27.4.SP3","build_of_quarkus 3.33.2.SP3"],"patched":["build_of_quarkus 3.27.4.SP3","build_of_quarkus 3.33.2.SP3"],"published":"2026-07-09","updated":"2026-10-20","sourceUpdated":"2026-10-20T04:42:50+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59900.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59900.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59900"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507480"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59900"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900"},{"url":"https://github.com/advisories/GHSA-c69g-56f8-xwqj"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"url":"https://access.redhat.com/errata/RHSA-2026:47189"},{"url":"https://access.redhat.com/errata/RHSA-2026:47172"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"epss":0.00398,"epssPercentile":0.3387,"aliases":["GHSA-c69g-56f8-xwqj"],"ecosystem":"maven","ingestedAt":"2026-07-22T22:06:57.658Z","slug":"CVE-2026-59900","body":"## Overview\n\nA flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can enable an attacker to manipulate web content or inject malicious headers.\n\n## Vendor advisories\n\n- **RHSA-2026:47189** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.4.SP3 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47189)\n- **RHSA-2026:47172** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.2.SP3 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:47172)\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · no fix planned: Red Hat Build of Keycloak, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform 7, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59900.json)\n\n**io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2** — rated Moderate by Red Hat. Released 2026-07-09, updated 2026-10-20.\n\nAffected:\n\n- Cryostat 4\n- OpenShift Serverless\n- Red Hat AMQ Broker 7\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Build of Keycloak\n- Red Hat build of Quarkus\n- Red Hat Data Grid 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nFixed:\n\n- Red Hat build of Quarkus 3.27.4.SP3\n- Red Hat build of Quarkus 3.33.2.SP3\n\nNo fix planned:\n\n- Red Hat Build of Keycloak\n- Red Hat build of Quarkus\n- Red Hat Data Grid 8\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n- Cryostat 4\n- OpenShift Serverless\n- Red Hat AMQ Broker 7\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n- streams for Apache Kafka 3\n\nNot affected:\n\n- Red Hat build of Quarkus 3.27.4.SP3\n- Red Hat build of Quarkus 3.33.2.SP3\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:47189\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:47172\n\nWorkarounds / mitigations:\n\n- - Upgrade `netty-codec-http2` to version 4.1.136.Final (4.1.x branch) or 4.2.16.Final (4.2.x branch).\n- If upgrading is not immediately possible, ensure that HTTP/2 traffic is routed through a reverse proxy or WAF that validates and sanitizes HTTP headers before forwarding to the Netty-based application.\n\n## Package advisory (CVE-2026-59900)\n\nAffected packages:\n\n- `io.netty:netty-codec-http2 >= 4.2.0.Final, <= 4.2.15.Final`\n- `io.netty:netty-codec-http2 < 4.1.136.Final`\n\nPatched in:\n\n- `io.netty:netty-codec-http2 4.2.16.Final`\n- `io.netty:netty-codec-http2 4.1.136.Final`\n\nSource: https://github.com/advisories/GHSA-c69g-56f8-xwqj","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225730,"id":"CVE-2026-59900","ts":1792498393067,"field":"cvss","old":null,"new":"6.5"}]}