CVE-2026-59900: 
Java vulnerability analysis and mitigation

CVE-2026-59900 is a Host header deduplication vulnerability in Netty's HTTP/2-to-HTTP/1.x translation layer, formally titled "[codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass." The flaw affects the io.netty:netty-codec-http2 Maven package in versions >= 4.2.0.Final through <= 4.2.15.Final and all versions < 4.1.136.Final. It was published by Netty maintainer normanmaurer on July 14, 2026, and added to the GitHub Advisory Database on July 22, 2026. The vulnerability carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Netty Security Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). When an HTTP/2 client sends a HEADERS frame containing both the :authority pseudo-header and a literal host header, Netty's Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter independently map :authority to a Host header and copy the literal host header without deduplication or conflict validation. The resulting HttpRequest object contains two Host headers with attacker-controlled, differing values. Downstream systems that rely on the Host header for routing, access control, or cache keying may interpret these conflicting values inconsistently, enabling request smuggling or cache poisoning attacks (GitHub Advisory, Netty Security Advisory).

Successful exploitation can enable HTTP request smuggling and cache poisoning attacks against downstream systems that process the translated HTTP/1.x requests. The primary impact is on subsequent systems — low confidentiality and low integrity impact — as an attacker can manipulate routing decisions, bypass Host-based access controls, or poison shared caches with malicious responses. The vulnerable system itself (the Netty instance) has no direct confidentiality, integrity, or availability impact, but applications sitting behind a Netty HTTP/2 gateway or reverse proxy are at risk of misdirected requests and data exposure (GitHub Advisory).

1. Reconnaissance: Identify services using Netty's io.netty:netty-codec-http2 in affected versions (>= 4.2.0.Final and <= 4.2.15.Final, or < 4.1.136.Final) that act as HTTP/2 gateways or reverse proxies translating to HTTP/1.x backends.
2. Craft malicious HEADERS frame: Construct an HTTP/2 HEADERS frame that includes both the :authority pseudo-header (e.g., :authority: legitimate-host.com) and a literal host header with a different, attacker-controlled value (e.g., host: attacker-controlled-host.com).
3. Send the request: Transmit the crafted HTTP/2 request to the vulnerable Netty endpoint. The translator will produce an HTTP/1.x HttpRequest containing two Host headers with differing values.
4. Exploit downstream ambiguity: Depending on the downstream system's behavior — proxy, cache, or application server — leverage the ambiguous dual Host headers to achieve request routing bypass (directing the request to an unintended backend), cache poisoning (storing a malicious response under a legitimate cache key), or Host-based access control bypass (GitHub Advisory).

• Network: HTTP/2 HEADERS frames containing both :authority and a literal host header with differing values arriving at Netty-based gateways or proxies; unexpected outbound requests from the Netty service to unintended backend hosts.
• Logs: HTTP/1.x access logs on downstream servers showing requests with duplicate or conflicting Host headers; anomalous routing to unexpected virtual hosts or backend services not matching the expected :authority value.
• Application Behavior: Cache entries served for unexpected hostnames; access control decisions based on Host header being bypassed, resulting in unauthorized access to restricted resources.

Upgrade to the patched versions: 4.2.16.Final (for the 4.2.x branch) or 4.1.136.Final (for the 4.1.x branch) of io.netty:netty-codec-http2. No specific configuration-based workaround has been published; upgrading is the recommended remediation. Organizations unable to upgrade immediately should consider placing an HTTP/2-aware WAF or proxy in front of affected Netty instances that rejects or normalizes requests containing both :authority and a conflicting host header (Netty 4.1.136.Final Release, Netty 4.2.16.Final Release).