CVE-2021-43797: Debian Linux

Medium severity, CVSS 6.5. EPSS: 2.9% chance of exploitation in the next 30 days.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

Affected products

Debian Debian Linux: version 10.0 only; version 11.0 only
Netapp Oncommand Workflow Automation: affected versions not specified
Netapp Snapcenter: affected versions not specified
Netty Netty: before 4.1.71 (fixed in 4.1.71)
Oracle Banking Deposits And Lines Of Credit Servicing: version 2.7 only
Oracle Banking Party Management: version 2.7.0 only
Oracle Banking Platform: version 2.6.2 only
Oracle Coherence: version 12.2.1.4.0 only; version 14.1.1.0.0 only
Oracle Communications Cloud Native Core Binding Support Function: version 1.11.0 only
Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
Oracle Communications Cloud Native Core Policy: version 1.15.0 only
Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.7.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.15.0 only
Oracle Communications Design Studio: version 7.4.2 only
Oracle Communications Instant Messaging Server: version 8.1 only
Oracle Helidon: version 1.4.10 only; version 2.4.0 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
Quarkus Quarkus: before 2.5.3 (fixed in 2.5.3)

Published 2021-12-09. Last modified 2026-10-08.