CVE-2021-22959: Debian Linux

Medium severity, CVSS 6.5. EPSS: 3.2% chance of exploitation in the next 30 days.

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

Affected products

• Debian Debian Linux: version 11.0 only
• Llhttp Llhttp: before 2.1.4 (fixed in 2.1.4); from 3.0.0, before 6.0.6 (fixed in 6.0.6)
• Oracle Graalvm: version 20.3.4 only; version 21.3.0 only

Published 2021-11-15. Last modified 2026-06-17.