{"vulnerability": "cve-2021-21295", "sightings": [{"uuid": "b17a6da7-4567-40fc-bd50-12446ece8596", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21295", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/24654", "content": "\u203c CVE-2021-21295 \u203c\n\nNetty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-09T22:52:04.000000Z"}, {"uuid": "35beafbd-4968-42e2-88db-e4ebeb1d9cb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21295", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4019", "content": "#tools\nBlack Hat USA 2021:\nHTTP/2: The Sequel is Always Worse (CVE-2021-21295)...\nhttps://portswigger.net/research/http2\n]-> Tool:\nhttps://github.com/PortSwigger/http-request-smuggler", "creation_timestamp": "2025-03-25T11:51:47.000000Z"}, {"uuid": "619eda70-f2cc-43dd-a787-82d7c8920af3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21295", "type": "seen", "source": "https://t.me/cissp/3982", "content": "exploit\nCVE-2021-29425:\nApache Commons IO <2.7 - \"Limited\" Path Traversal (PoC)\nhttps://github.com/AlAIAL90/CVE-2021-29425\n\nBlack Hat USA 2021:\nHTTP/2: The Sequel is Always Worse (CVE-2021-21295)...\nhttps://portswigger.net/research/http2\n]-> Tool:\nhttps://github.com/PortSwigger/http-request-smuggler\n\nThreat Research\n1. CVE-2021-20090 - Attack Details\nhttps://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild\n2. OTP bypass and Account takeover using response manipulation\nhttps://infosecwriteups.com/otp-bypass-and-account-takeover-using-response-manipulation-685ad4e1ea76", "creation_timestamp": "2026-09-01T17:00:43.294668Z"}, {"uuid": "f5882f5c-401d-4e37-a8ad-e04c750aed30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21295", "type": "seen", "source": "https://t.me/cissp/3982", "content": "exploit\nCVE-2021-29425:\nApache Commons IO <2.7 - \"Limited\" Path Traversal (PoC)\nhttps://github.com/AlAIAL90/CVE-2021-29425\n\nBlack Hat USA 2021:\nHTTP/2: The Sequel is Always Worse (CVE-2021-21295)...\nhttps://portswigger.net/research/http2\n]-> Tool:\nhttps://github.com/PortSwigger/http-request-smuggler\n\nThreat Research\n1. CVE-2021-20090 - Attack Details\nhttps://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild\n2. OTP bypass and Account takeover using response manipulation\nhttps://infosecwriteups.com/otp-bypass-and-account-takeover-using-response-manipulation-685ad4e1ea76", "creation_timestamp": "2026-09-02T01:04:30.611847Z"}, {"uuid": "1b490b98-0b01-46c4-b0d1-3f41c0045919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21295", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3982", "content": "exploit\nCVE-2021-29425:\nApache Commons IO <2.7 - \"Limited\" Path Traversal (PoC)\nhttps://github.com/AlAIAL90/CVE-2021-29425\n\nBlack Hat USA 2021:\nHTTP/2: The Sequel is Always Worse (CVE-2021-21295)...\nhttps://portswigger.net/research/http2\n]-> Tool:\nhttps://github.com/PortSwigger/http-request-smuggler\n\nThreat Research\n1. CVE-2021-20090 - Attack Details\nhttps://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild\n2. OTP bypass and Account takeover using response manipulation\nhttps://infosecwriteups.com/otp-bypass-and-account-takeover-using-response-manipulation-685ad4e1ea76", "creation_timestamp": "2026-09-10T23:00:05.120757Z"}, {"uuid": "43b1a83d-6280-4c7d-8e69-aab2c8dba634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21295", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3982", "content": "exploit\nCVE-2021-29425:\nApache Commons IO <2.7 - \"Limited\" Path Traversal (PoC)\nhttps://github.com/AlAIAL90/CVE-2021-29425\n\nBlack Hat USA 2021:\nHTTP/2: The Sequel is Always Worse (CVE-2021-21295)...\nhttps://portswigger.net/research/http2\n]-> Tool:\nhttps://github.com/PortSwigger/http-request-smuggler\n\nThreat Research\n1. CVE-2021-20090 - Attack Details\nhttps://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild\n2. OTP bypass and Account takeover using response manipulation\nhttps://infosecwriteups.com/otp-bypass-and-account-takeover-using-response-manipulation-685ad4e1ea76", "creation_timestamp": "2026-09-11T00:00:09.673667Z"}]}