Azure / Azure/DotNetty

Is (or was) DotNetty vulnerabile w.r.t. "HTTP request smuggling" like the Java variant was?

Open
#576 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
4.3k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

The Java variant "Netty" had a security vulnerability in the past: [HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling](https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq) (see also [CVE-2021-43797](https://nvd.nist.gov/vuln/detail/CVE-2021-43797)). Apparently, this security issue was fixed [on Dec 9, 2021](https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323).

Can you tell me if DotNetty was / is subject to this vulnerability, too? If it was in the past but isn't anymore I would also be interested in the first DotNetty version (or the fixing commit) which isn't vulnerable anymore.

Many thanks in advance

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.