AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2021-21409.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSMEDIUM / 5.9CVSS 3.1 · nvd@nist.gov
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSModifiedModified Oct 08, 2026

Disclosure summary

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

Source-reported weakness categories

CWE-444

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2021-21409

Open original source · Updated Oct 08, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

VendorProduct / associationVersion / bounds
nettynetty* {"versionEndExcluding":"4.1.61"}
debiandebian_linux10.0
netapponcommand_api_services-
netapponcommand_workflow_automation-
oraclebanking_corporate_lending_process_management14.2.0
oraclebanking_corporate_lending_process_management14.3.0
oraclebanking_corporate_lending_process_management14.5.0
oraclebanking_credit_facilities_process_management14.2.0
oraclebanking_credit_facilities_process_management14.3.0
oraclebanking_credit_facilities_process_management14.5.0
oraclebanking_trade_finance_process_management14.2.0
oraclebanking_trade_finance_process_management14.3.0
oraclebanking_trade_finance_process_management14.5.0
oraclecoherence12.2.1.4.0
oraclecoherence14.1.1.0.0
oraclecommunications_brm_-_elastic_charging_engine12.0.0.3
oraclecommunications_cloud_native_core_console1.7.0
oraclecommunications_cloud_native_core_policy1.14.0
oraclecommunications_design_studio7.4.2.0.0
oraclecommunications_messaging_server8.1
oraclehelidon1.4.10
oraclehelidon2.4.0
oraclejd_edwards_enterpriseone_tools* {"versionEndExcluding":"9.2.6.3"}
oraclenosql_database* {"versionEndExcluding":"21.1.12"}
oracleprimavera_gateway* {"versionStartIncluding":"19.12.0","versionEndIncluding":"19.12.10"}
quarkusquarkus* {"versionEndIncluding":"1.13.7"}

Original records & references

PUBLISHED 2021-03-30T11:15:14-04:00
MODIFIED 2026-10-08T18:17:06-04:00
INGESTED 2026-10-10T20:50:20-04:00