PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59900 netty CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T18:16:56.320Z and has not been modified since then. Netty's HTTP/2-to-HTTP/1.x translation layer fails to deduplicate or validate 'Host' headers when an HTTP/2 client supplies both the ':authority' pseudo-header and a literal 'host' header in a single HEADERS frame. The translator maps ':authority' to 'Host' and separately copies the literal 'host' header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. Users of Netty should review and update their systems to prevent potential attacks. The CVE record indicates a vulnerability in Netty's HTTP/2-to-HTTP/1.x translation layer. Further review of source item and vendor references recommended. Users should verify affected systems and components for CVE-2026-59900. Netty versions prior to 4.1.136.Final and 4.2.16.Final are affected.

Vendor
netty
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-08-06
Advisory published
2026-07-29
Advisory updated
2026-08-06

Who should care

Users of Netty versions prior to 4.1.136.Final and 4.2.16.Final should review and update their systems. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential impact of this vulnerability on their systems and take necessary actions to mitigate it.

Technical summary

Netty's HTTP/2-to-HTTP/1.x translation layer fails to deduplicate or validate 'Host' headers when an HTTP/2 client supplies both the ':authority' pseudo-header and a literal 'host' header in a single HEADERS frame. The translator maps ':authority' to 'Host' and separately copies the literal 'host' header, producing an HttpRequest object containing two Host headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. Users of Netty should review and update their systems to prevent potential attacks.

Defensive priority

Medium-priority defensive review recommended due to potential HTTP/2-to-HTTP/1.x translation layer vulnerability in Netty.

Recommended defensive actions

  • Review Netty versions and apply updates to 4.1.136.Final or 4.2.16.Final
  • Verify affected systems and components for CVE-2026-59900
  • Monitor for potential HTTP/2-to-HTTP/1.x translation layer attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from official CVE and NVD sources indicates a vulnerability in Netty's HTTP/2-to-HTTP/1.x translation layer. Further review of source item and vendor references recommended. The CVE record was published on 2026-07-29T18:16:56.320Z and has not been modified since then. Users should verify affected systems and components for CVE-2026-59900. Netty versions prior to 4.1.136.Final and 4.2.16.Final are affected.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T18:16:56.320Z and has not been modified since then.