[GHSA-wx5j-54mm-rqqq] HTTP request smuggling in netty

[poc-effectiveness]

Updates

• Affected products

Comments
This will be our last PR in the near term, thank you sincerely for your support and assistance throughout our research.

We are writing to request an update to the affected version range for CVE-2021-43797 in the GitHub Advisory Database.

According to the official NVD listing: https://nvd.nist.gov/vuln/detail/CVE-2021-43797
The vulnerability affects Netty prior to version 4.1.71.Final, which means pre-release versions for 4.x are affected.

However, the current GitHub advisory version range only covers:
≥ 4.0.0, < 4.1.71.Final

We have validated this through manual testing, and to support this claim, we have provided working PoCs:
https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2021-43797

[github]

Hi there @normanmaurer! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory