{
  "cveId": "CVE-2021-21409",
  "url": "https://patchblox.com/security/cve/CVE-2021-21409",
  "summary": "CVE-2021-21409 is fixed in 2 products on 1 platform, first by RLSA-2022:5498, released July 5, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable...",
  "description": "Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable high performance protocolservers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version4.1.61.Final there is a vulnerability that enables request smuggling. Thecontent-length header is not correctly validated if the request only uses asingle Http2HeaderFrame with the endStream set to to true. This could leadto request smuggling if the request is proxied to a remote peer andtranslated to HTTP/1.1. This is a followup ofGHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case.This was fixed as part of 4.1.61.Final.",
  "published": "2021-03-30T08:15:00Z",
  "severity": "Medium",
  "epss": 0.04935,
  "epssPercentile": 0.922,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libdb",
      "release": "rocky 8",
      "fixedVersion": "0:5.3.28-42.el8_4",
      "fix": "RLSA-2022:5498",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-5498",
      "released": "2022-07-05T13:55:16Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:4.1.7-4ubuntu0.1\u002Besm2",
      "fix": "libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm2",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:4.1.45-1ubuntu0.1~esm1",
      "fix": "libnetty-java 1:4.1.45-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "fix": "libnetty-java 1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u1build0.22.04.1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.1.48-4",
      "fix": "libnetty-java 4.1.48-4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libnetty-java-4.1.48-4",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "4.1.48-4",
      "fix": "libnetty-java 4.1.48-4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libnetty-java-4.1.48-4",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}