--- id: CVE-2026-59900 title: >- io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2 (CVE-2026-59900) summary: >- A flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP respons… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N' cvssSource: vendor cwe: - CWE-113 - CWE-444 vendor: Red Hat product: OpenShift Serverless affected: - cryostat 4 - openshift_serverless - amq_broker 7 - build_of_apache_camel_hawtio 4 - build_of_apache_camel_4_for_quarkus 3 - build_of_apache_camel_for_spring_boot 4 - build_of_apicurio_registry 3 - build_of_debezium 3 - build_of_keycloak - build_of_quarkus - data_grid 8 - enterprise_linux_ai_rhel_ai 3 - jboss_enterprise_application_platform 7 - jboss_enterprise_application_platform_expansion_pack - openshift_ai_rhoai - openshift_dev_spaces - single_sign_on 7 - streams_for_apache_kafka 2 - streams_for_apache_kafka 3 - build_of_quarkus 3.27.4.SP3 - build_of_quarkus 3.33.2.SP3 patched: - build_of_quarkus 3.27.4.SP3 - build_of_quarkus 3.33.2.SP3 published: '2026-07-09' updated: '2026-10-20' sourceUpdated: '2026-10-20T04:42:50+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59900.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59900.json - url: 'https://access.redhat.com/security/cve/CVE-2026-59900' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507480' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59900' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59900' - url: 'https://github.com/advisories/GHSA-c69g-56f8-xwqj' - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.136.Final' - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.16.Final' - url: 'https://access.redhat.com/errata/RHSA-2026:47189' - url: 'https://access.redhat.com/errata/RHSA-2026:47172' - url: 'https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj' tags: - csaf - vex - red-hat - ghsa - maven epss: 0.00398 epssPercentile: 0.3387 aliases: - GHSA-c69g-56f8-xwqj ecosystem: maven ingestedAt: '2026-07-22T22:06:57.658Z' --- ## Overview A flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can enable an attacker to manipulate web content or inject malicious headers. ## Vendor advisories - **RHSA-2026:47189** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.4.SP3 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47189) - **RHSA-2026:47172** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.2.SP3 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:47172) - **Red Hat VEX** · Moderate · affected: Cryostat 4, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · no fix planned: Red Hat Build of Keycloak, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform 7, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59900.json) **io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2** — rated Moderate by Red Hat. Released 2026-07-09, updated 2026-10-20. Affected: - Cryostat 4 - OpenShift Serverless - Red Hat AMQ Broker 7 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat build of Apache Camel 4 for Quarkus 3 - Red Hat build of Apache Camel for Spring Boot 4 - Red Hat build of Apicurio Registry 3 - Red Hat build of Debezium 3 - Red Hat Build of Keycloak - Red Hat build of Quarkus - Red Hat Data Grid 8 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat JBoss Enterprise Application Platform 7 - Red Hat JBoss Enterprise Application Platform Expansion Pack - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Dev Spaces - Red Hat Single Sign-On 7 - streams for Apache Kafka 2 - streams for Apache Kafka 3 Fixed: - Red Hat build of Quarkus 3.27.4.SP3 - Red Hat build of Quarkus 3.33.2.SP3 No fix planned: - Red Hat Build of Keycloak - Red Hat build of Quarkus - Red Hat Data Grid 8 - Red Hat JBoss Enterprise Application Platform 7 - Red Hat Single Sign-On 7 - streams for Apache Kafka 2 - Cryostat 4 - OpenShift Serverless - Red Hat AMQ Broker 7 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat build of Apache Camel 4 for Quarkus 3 - Red Hat build of Apache Camel for Spring Boot 4 - Red Hat build of Apicurio Registry 3 - Red Hat build of Debezium 3 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat JBoss Enterprise Application Platform Expansion Pack - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Dev Spaces - streams for Apache Kafka 3 Not affected: - Red Hat build of Quarkus 3.27.4.SP3 - Red Hat build of Quarkus 3.33.2.SP3 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:47189 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:47172 Workarounds / mitigations: - - Upgrade `netty-codec-http2` to version 4.1.136.Final (4.1.x branch) or 4.2.16.Final (4.2.x branch). - If upgrading is not immediately possible, ensure that HTTP/2 traffic is routed through a reverse proxy or WAF that validates and sanitizes HTTP headers before forwarding to the Netty-based application. ## Package advisory (CVE-2026-59900) Affected packages: - `io.netty:netty-codec-http2 >= 4.2.0.Final, <= 4.2.15.Final` - `io.netty:netty-codec-http2 < 4.1.136.Final` Patched in: - `io.netty:netty-codec-http2 4.2.16.Final` - `io.netty:netty-codec-http2 4.1.136.Final` Source: https://github.com/advisories/GHSA-c69g-56f8-xwqj