Is (or was) DotNetty vulnerabile w.r.t. "HTTP request smuggling" like the Java variant was?
- Dominant language
- C#
- Stars
- 4.3k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
The Java variant "Netty" had a security vulnerability in the past: [HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling](https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq) (see also [CVE-2021-43797](https://nvd.nist.gov/vuln/detail/CVE-2021-43797)). Apparently, this security issue was fixed [on Dec 9, 2021](https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323).
Can you tell me if DotNetty was / is subject to this vulnerability, too? If it was in the past but isn't anymore I would also be interested in the first DotNetty version (or the fixing commit) which isn't vulnerable anymore.
Many thanks in advance
Contributor guide
Assessment
This issue has not been assessed yet.