CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer "Http2StreamFrameToHttpObjectCodec" and "InboundHttp2ToHttpAdapter" fails to deduplicate or validate "Host" headers when an HTTP/2...