Detections
Analytics

SCA: security update for io.netty:netty-codec-http (GHSA-wx5j-54mm-rqqq)

medium Tenable Cloud Security Plugin ID 420171

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Netty is an asynchronous event-driven network application framework for rapid development of maintainable
 high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when
 they are present at the beginning / end of the header name. It should instead fail fast as these are not
 allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause
 netty to "sanitize" header names before it forward these to another remote system when used as proxy. This
 remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users
 should upgrade to version 4.1.71.Final. (CVE-2021-43797)

See Also

https://github.com/advisories/GHSA-wx5j-54mm-rqqq

Plugin Details

Severity: Medium

ID: 420171

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2021-43797

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/9/2021

Vulnerability Publication Date: 12/9/2021

Reference Information

CVE: CVE-2021-43797

cwe: CWE-444