CVE-2021-43797

CVE-2021-43797 is a medium-severity vulnerability in Netty, an asynchronous network application framework, affecting versions prior to 4.1.71.Final, as well as products like Debian, NetApp, Oracle, and Quarkus. The flaw allows HTTP request smuggling due to Netty's failure to properly validate and reject control characters at the beginning or end of HTTP header names. This could enable an attacker to "sanitize" malicious headers before they reach a backend system, bypassing its own validation. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited over the network with low attack complexity, requiring user interaction, and potentially leading to high integrity impact. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.