libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable...

Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable high performance protocolservers & clients. In Netty (io.netty:netty-codec-http2) before version4.1.60.Final there is a vulnerability that enables request smuggling. If aContent-Length header is present in the original HTTP/2 request, the fieldis not validated by `Http2MultiplexHandler` as it is propagated up. This isfine as long as the request is not proxied through as HTTP/1.1. If therequest comes in as an HTTP/2 stream, gets converted into the HTTP/1.1domain objects (`HttpRequest`, `HttpContent`, etc.) via`Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel'spipeline and proxied through a remote peer as HTTP/1.1 this may result inrequest smuggling. In a proxy case, users may assume the content-length isvalidated somehow, which is not the case. If the request is forwarded to abackend channel that is a HTTP/1.1 connection, the Content-Length now hasmeaning and needs to be checked. An attacker can smuggle requests insidethe body as it gets downgraded from HTTP/2 to HTTP/1.1. For an exampleattack refer to the linked GitHub Advisory. Users are only affected if allof this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used,`Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects,and these HTTP/1.1 objects are forwarded to another remote peer. This hasbeen patched in 4.1.60.Final As a workaround, the user can do thevalidation by themselves by implementing a custom `ChannelInboundHandler`that is put in the `ChannelPipeline` behind`Http2StreamFrameToHttpObjectCodec`.

Where it's fixed