Dependency-Check Report

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation, CWE-626 Null Byte Interaction Error (Poison Null Byte), CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv4:

Base Score: HIGH (8.3)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-697 Incorrect Comparison, CWE-1287 Improper Validation of Specified Type of Input, CWE-284 Improper Access Control

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

CVE-2026-42577

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.13

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

CWE-789 Memory Allocation with Excessive Size Value, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.13

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

CVE-2026-44892

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.

CWE-400 Uncontrolled Resource Consumption, CWE-1188 Insecure Default Initialization of Resource

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-703 Improper Check or Handling of Exceptional Conditions, CWE-805 Buffer Access with Incorrect Length Value

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-44894

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue.

CWE-940 Improper Verification of Source of a Communication Channel, CWE-346 Origin Validation Error

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-48748

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.16

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: HIGH (7.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - NOT_APPLICABLE
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-340 Generation of Predictable Numbers or Identifiers, CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-284 Improper Access Control

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:2.8/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - VENDOR_ADVISORY
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-50009

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

CWE-330 Use of Insufficiently Random Values, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv3:

Base Score: MEDIUM (4.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (4.0)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:2.5/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/grprdist/.m2/repository/io/netty/netty-codec-compression/4.2.7.Final/netty-codec-compression-4.2.7.Final.jar
MD5: d7df10ca556335a43abfa4e5e848b5b1
SHA1: 572341bc1ca90fd9d6e47f1d2694aab5258566e9
SHA256:edd53ad34991804301a46571113d8ffb4d6f67e6d874674dafbb915724275cb3
Referenced In Project/Scope: Grouper Authentication Logic:provided
pkg:maven/edu.internet2.middleware.grouper/grouper@7.0.0-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	netty-codec-compression	High
Vendor	jar	package name	codec	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	netty	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-docurl	https://netty.io/	Low
Vendor	Manifest	bundle-symbolicname	io.netty.codec-compression	Medium
Vendor	Manifest	implementation-url	https://netty.io/netty-codec-compression/	Low
Vendor	Manifest	Implementation-Vendor	The Netty Project	High
Vendor	Manifest	Implementation-Vendor-Id	io.netty	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Netty Project	Low
Vendor	pom	artifactid	netty-codec-compression	Highest
Vendor	pom	artifactid	netty-codec-compression	Low
Vendor	pom	groupid	io.netty	Highest
Vendor	pom	name	Netty/Codec/Compression	High
Vendor	pom	parent-artifactid	netty-parent	Low
Product	file	name	netty-codec-compression	High
Product	jar	package name	11	Highest
Product	jar	package name	codec	Highest
Product	jar	package name	io	Highest
Product	jar	package name	netty	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	bundle-docurl	https://netty.io/	Low
Product	Manifest	Bundle-Name	Netty/Codec/Compression	Medium
Product	Manifest	bundle-symbolicname	io.netty.codec-compression	Medium
Product	Manifest	Implementation-Title	Netty/Codec/Compression	High
Product	Manifest	implementation-url	https://netty.io/netty-codec-compression/	Low
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Netty/Codec/Compression	Medium
Product	pom	artifactid	netty-codec-compression	Highest
Product	pom	groupid	io.netty	Highest
Product	pom	name	Netty/Codec/Compression	High
Product	pom	parent-artifactid	netty-parent	Medium
Version	Manifest	Bundle-Version	4.2.7.Final	High
Version	Manifest	Implementation-Version	4.2.7.Final	High
Version	pom	version	4.2.7.Final	Highest

Identifiers

pkg:maven/io.netty/netty-codec-compression@4.2.7.Final (Confidence:High)
cpe:2.3:a:netty:netty:4.2.7:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation, CWE-626 Null Byte Interaction Error (Poison Null Byte), CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59901 (OSSINDEX)

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv2:

Base Score: HIGH (8.699999809265137)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References:

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:io.netty:netty-codec-compression:4.2.7.Final:*:*:*:*:*:*:*

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv4:

Base Score: HIGH (8.3)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-697 Incorrect Comparison, CWE-1287 Improper Validation of Specified Type of Input, CWE-284 Improper Access Control

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

CVE-2026-42577

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.13

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

CWE-789 Memory Allocation with Excessive Size Value, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.13

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-42583] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-42583
OSSIndex - https://github.com/advisories/GHSA-mj4r-2hfc-f8p6
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

CVE-2026-44892

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.

CWE-400 Uncontrolled Resource Consumption, CWE-1188 Insecure Default Initialization of Resource

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-703 Improper Check or Handling of Exceptional Conditions, CWE-805 Buffer Access with Incorrect Length Value

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-44894

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue.

CWE-940 Improper Verification of Source of a Communication Channel, CWE-346 Origin Validation Error

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-48748

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.16

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: HIGH (7.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - NOT_APPLICABLE
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-340 Generation of Predictable Numbers or Identifiers, CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-284 Improper Access Control

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:2.8/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - VENDOR_ADVISORY
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-50009

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

CWE-330 Use of Insufficiently Random Values, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv3:

Base Score: MEDIUM (4.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (4.0)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:2.5/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/grprdist/.m2/repository/io/netty/netty-codec-http/4.1.72.Final/netty-codec-http-4.1.72.Final.jar
MD5: 299f0a5309cdd6b88c370a0c3d52ee4d
SHA1: a8f062d67303a5e4b2bc2ad48fb4fd8c99108e45
SHA256:fa6fec88010bfaf6a7415b5364671b6b18ffb6b35a986ab97b423fd8c3a0174b
Referenced In Project/Scope: Grouper Authentication Logic:provided
pkg:maven/edu.internet2.middleware.grouper/grouper@7.0.0-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	netty-codec-http	High
Vendor	jar	package name	codec	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	netty	Highest
Vendor	Manifest	automatic-module-name	io.netty.codec.http	Medium
Vendor	Manifest	bundle-docurl	https://netty.io/	Low
Vendor	Manifest	bundle-symbolicname	io.netty.codec-http	Medium
Vendor	Manifest	implementation-url	https://netty.io/netty-codec-http/	Low
Vendor	Manifest	Implementation-Vendor	The Netty Project	High
Vendor	Manifest	Implementation-Vendor-Id	io.netty	Medium
Vendor	pom	artifactid	netty-codec-http	Highest
Vendor	pom	artifactid	netty-codec-http	Low
Vendor	pom	groupid	io.netty	Highest
Vendor	pom	name	Netty/Codec/HTTP	High
Vendor	pom	parent-artifactid	netty-parent	Low
Product	file	name	netty-codec-http	High
Product	jar	package name	codec	Highest
Product	jar	package name	io	Highest
Product	jar	package name	netty	Highest
Product	Manifest	automatic-module-name	io.netty.codec.http	Medium
Product	Manifest	bundle-docurl	https://netty.io/	Low
Product	Manifest	Bundle-Name	Netty/Codec/HTTP	Medium
Product	Manifest	bundle-symbolicname	io.netty.codec-http	Medium
Product	Manifest	Implementation-Title	Netty/Codec/HTTP	High
Product	Manifest	implementation-url	https://netty.io/netty-codec-http/	Low
Product	pom	artifactid	netty-codec-http	Highest
Product	pom	groupid	io.netty	Highest
Product	pom	name	Netty/Codec/HTTP	High
Product	pom	parent-artifactid	netty-parent	Medium
Version	Manifest	Bundle-Version	4.1.72.Final	High
Version	Manifest	Implementation-Version	4.1.72.Final	High
Version	pom	version	4.1.72.Final	Highest

Identifiers

pkg:maven/io.netty/netty-codec-http@4.1.72.Final (Confidence:High)
cpe:2.3:a:netty:netty:4.1.72:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-42581] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-42581
OSSIndex - https://github.com/advisories/GHSA-xxqh-mfjm-7mv9
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation, CWE-626 Null Byte Interaction Error (Poison Null Byte), CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-42584] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-42584
OSSIndex - https://github.com/advisories/GHSA-57rv-r2g8-2cj3
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-56745] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-56745
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv4:

Base Score: HIGH (8.3)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-55163

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.2)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-697 Incorrect Comparison, CWE-1287 Improper Validation of Specified Type of Input, CWE-284 Improper Access Control

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2022-41881

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

CWE-674 Uncontrolled Recursion

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security-advisories@github.com - EXPLOIT,THIRD_PARTY_ADVISORY
security-advisories@github.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.86

CVE-2023-44487

CISA Known Exploited Vulnerability:

Product: IETF HTTP/2
Name: HTTP/2 Rapid Reset Attack Vulnerability
Date Added: 2023-10-10
Description: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Notes: This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487; https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/; https://nvd.nist.gov/vuln/detail/CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CWE-400 Uncontrolled Resource Consumption, NVD-CWE-noinfo

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
134c704f-9b21-4f2e-91b3-4a467353bcc0 - US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,MITIGATION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PRESS/MEDIA_COVERAGE
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MITIGATION,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MITIGATION,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MITIGATION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT,RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - BROKEN_LINK
cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING,MITIGATION,VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PRESS/MEDIA_COVERAGE
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING,VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,PATCH,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST,RELEASE_NOTES,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST,VENDOR_ADVISORY
cve@mitre.org - MITIGATION,PATCH,VENDOR_ADVISORY
cve@mitre.org - MITIGATION,PATCH,VENDOR_ADVISORY
cve@mitre.org - MITIGATION,VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - PATCH
cve@mitre.org - PATCH
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRODUCT
cve@mitre.org - PRODUCT
cve@mitre.org - PRODUCT,RELEASE_NOTES
cve@mitre.org - PRODUCT,THIRD_PARTY_ADVISORY
cve@mitre.org - RELEASE_NOTES
cve@mitre.org - RELEASE_NOTES
cve@mitre.org - RELEASE_NOTES,THIRD_PARTY_ADVISORY
cve@mitre.org - RELEASE_NOTES,VENDOR_ADVISORY
cve@mitre.org - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
cve@mitre.org - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
cve@mitre.org - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-33870] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-33870
OSSIndex - https://github.com/advisories/GHSA-pwqr-wmgm-9rr8
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-42585] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-42585
OSSIndex - https://github.com/advisories/GHSA-38f8-5428-x5cv
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-42587] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-42587
OSSIndex - https://github.com/advisories/GHSA-f6hv-jmp6-3vwv
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-703 Improper Check or Handling of Exceptional Conditions, CWE-805 Buffer Access with Incorrect Length Value

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-55831] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-55831
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-55833] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-55833
OSSIndex - https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
OSSIndex - https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.16

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: HIGH (7.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59899 (OSSINDEX)

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: MEDIUM (6.900000095367432)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References:

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:io.netty:netty-codec-http:4.1.72.Final:*:*:*:*:*:*:*

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2025-58057] CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-58057
OSSIndex - https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - NOT_APPLICABLE
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-340 Generation of Predictable Numbers or Identifiers, CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2023-34462

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.94

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2025-67735] CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-67735
OSSIndex - https://github.com/advisories/GHSA-84h7-rjj3-6jx4
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-42580] CWE-190: Integer Overflow or Wraparound
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-42580
OSSIndex - https://github.com/advisories/GHSA-m4cv-j2px-7723
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-284 Improper Access Control

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-56746] CWE-284: Improper Access Control
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-56746
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-59898 (OSSINDEX)

Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv2:

Base Score: MEDIUM (6.300000190734863)
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References:

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:io.netty:netty-codec-http:4.1.72.Final:*:*:*:*:*:*:*

CVE-2026-59921 (OSSINDEX)

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.699999809265137)
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:io.netty:netty-codec-http:4.1.72.Final:*:*:*:*:*:*:*

CVE-2022-24823

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Insecure Permissions, CWE-668 Exposure of Resource to Wrong Sphere

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: LOW (1.9)
Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2024-47535

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.115

CVE-2025-25193

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.118

CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2024-29025] CWE-770: Allocation of Resources Without Limits or Throttling
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29025
OSSIndex - https://github.com/advisories/GHSA-5jpm-x58v-624v
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
security-advisories@github.com - EXPLOIT
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.108

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
OSSINDEX - [CVE-2026-41417] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-41417
OSSIndex - https://github.com/advisories/GHSA-v8h7-rr48-vmmv
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - VENDOR_ADVISORY
OSSINDEX - [CVE-2026-50020] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-50020
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (4.0)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:2.5/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-58056

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2025-58056] CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-58056
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49
security-advisories@github.com - BROKEN_LINK
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/grprdist/.m2/repository/io/netty/netty-codec-protobuf/4.2.7.Final/netty-codec-protobuf-4.2.7.Final.jar
MD5: 8b1621b16afd1dbe5c10c1140e1c3796
SHA1: 228896874d933b1111cdf495c6a57e1207956a99
SHA256:4b25259b6f75ebfc77f014a08f69bad019116d4f5ca548fdc41f3dad8c0de331
Referenced In Project/Scope: Grouper Authentication Logic:provided
pkg:maven/edu.internet2.middleware.grouper/grouper@7.0.0-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	netty-codec-protobuf	High
Vendor	jar	package name	codec	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	netty	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-docurl	https://netty.io/	Low
Vendor	Manifest	bundle-symbolicname	io.netty.codec-protobuf	Medium
Vendor	Manifest	implementation-url	https://netty.io/netty-codec-protobuf/	Low
Vendor	Manifest	Implementation-Vendor	The Netty Project	High
Vendor	Manifest	Implementation-Vendor-Id	io.netty	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Netty Project	Low
Vendor	pom	artifactid	netty-codec-protobuf	Highest
Vendor	pom	artifactid	netty-codec-protobuf	Low
Vendor	pom	groupid	io.netty	Highest
Vendor	pom	name	Netty/Codec/Protobuf	High
Vendor	pom	parent-artifactid	netty-parent	Low
Product	file	name	netty-codec-protobuf	High
Product	jar	package name	11	Highest
Product	jar	package name	codec	Highest
Product	jar	package name	io	Highest
Product	jar	package name	netty	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	bundle-docurl	https://netty.io/	Low
Product	Manifest	Bundle-Name	Netty/Codec/Protobuf	Medium
Product	Manifest	bundle-symbolicname	io.netty.codec-protobuf	Medium
Product	Manifest	Implementation-Title	Netty/Codec/Protobuf	High
Product	Manifest	implementation-url	https://netty.io/netty-codec-protobuf/	Low
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Netty/Codec/Protobuf	Medium
Product	pom	artifactid	netty-codec-protobuf	Highest
Product	pom	groupid	io.netty	Highest
Product	pom	name	Netty/Codec/Protobuf	High
Product	pom	parent-artifactid	netty-parent	Medium
Version	Manifest	Bundle-Version	4.2.7.Final	High
Version	Manifest	Implementation-Version	4.2.7.Final	High
Version	pom	version	4.2.7.Final	Highest

Identifiers

pkg:maven/io.netty/netty-codec-protobuf@4.2.7.Final (Confidence:High)
cpe:2.3:a:netty:netty:4.2.7:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:protobuf:protobuf:4.2.7:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation, CWE-626 Null Byte Interaction Error (Poison Null Byte), CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv4:

Base Score: HIGH (8.3)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-697 Incorrect Comparison, CWE-1287 Improper Validation of Specified Type of Input, CWE-284 Improper Access Control

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

CVE-2026-42577

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.13

CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

CWE-789 Memory Allocation with Excessive Size Value, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.13

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

CVE-2026-44892

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.

CWE-400 Uncontrolled Resource Consumption, CWE-1188 Insecure Default Initialization of Resource

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-703 Improper Check or Handling of Exceptional Conditions, CWE-805 Buffer Access with Incorrect Length Value

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-44894

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue.

CWE-940 Improper Verification of Source of a Communication Channel, CWE-346 Origin Validation Error

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-48748

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.16

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: HIGH (7.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - NOT_APPLICABLE
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-340 Generation of Predictable Numbers or Identifiers, CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-284 Improper Access Control

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:2.8/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - VENDOR_ADVISORY
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2026-50009

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

CWE-330 Use of Insufficiently Random Values, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv3:

Base Score: MEDIUM (4.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0; versions up to (excluding) 4.2.15

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (4.0)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:2.5/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Java Concurrency Tools Core Library

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/grprdist/.m2/repository/io/netty/netty-common/4.1.72.Final/netty-common-4.1.72.Final.jar/META-INF/maven/org.jctools/jctools-core/pom.xml
MD5: 08e7326c64d7fd6ae4ea32e7eb4e5b79
SHA1: 9deceaba814dea198202b04fe0eec0d2dbf69ea9
SHA256:acaf1b4c366f6794a734288a2c003f16af90a9c479cf4d7daade689764e4fb47
Referenced In Project/Scope: Grouper Authentication Logic:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	pom	artifactid	jctools-core	Low
Vendor	pom	groupid	org.jctools	Highest
Vendor	pom	name	Java Concurrency Tools Core Library	High
Vendor	pom	url	JCTools	Highest
Product	pom	artifactid	jctools-core	Highest
Product	pom	groupid	org.jctools	Highest
Product	pom	name	Java Concurrency Tools Core Library	High
Product	pom	url	JCTools	High
Version	pom	version	3.1.0	Highest

Identifiers

pkg:maven/org.jctools/jctools-core@3.1.0 (Confidence:High)

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/grprdist/.m2/repository/io/netty/netty-transport/4.1.72.Final/netty-transport-4.1.72.Final.jar
MD5: 6f4128413f9200c948bcceb2299bb7e5
SHA1: 99138b436a584879355aca8fe3c64b46227d5d79
SHA256:c5fb68e9a65b6e8a516adfcb9fa323479ee7b4d9449d8a529d2ecab3d3711d5a
Referenced In Project/Scope: Grouper Authentication Logic:provided
pkg:maven/edu.internet2.middleware.grouper/grouper@7.0.0-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	netty-transport	High
Vendor	jar	package name	io	Highest
Vendor	jar	package name	netty	Highest
Vendor	Manifest	automatic-module-name	io.netty.transport	Medium
Vendor	Manifest	bundle-docurl	https://netty.io/	Low
Vendor	Manifest	bundle-symbolicname	io.netty.transport	Medium
Vendor	Manifest	implementation-url	https://netty.io/netty-transport/	Low
Vendor	Manifest	Implementation-Vendor	The Netty Project	High
Vendor	Manifest	Implementation-Vendor-Id	io.netty	Medium
Vendor	pom	artifactid	netty-transport	Highest
Vendor	pom	artifactid	netty-transport	Low
Vendor	pom	groupid	io.netty	Highest
Vendor	pom	name	Netty/Transport	High
Vendor	pom	parent-artifactid	netty-parent	Low
Product	file	name	netty-transport	High
Product	jar	package name	io	Highest
Product	jar	package name	netty	Highest
Product	Manifest	automatic-module-name	io.netty.transport	Medium
Product	Manifest	bundle-docurl	https://netty.io/	Low
Product	Manifest	Bundle-Name	Netty/Transport	Medium
Product	Manifest	bundle-symbolicname	io.netty.transport	Medium
Product	Manifest	Implementation-Title	Netty/Transport	High
Product	Manifest	implementation-url	https://netty.io/netty-transport/	Low
Product	pom	artifactid	netty-transport	Highest
Product	pom	groupid	io.netty	Highest
Product	pom	name	Netty/Transport	High
Product	pom	parent-artifactid	netty-parent	Medium
Version	Manifest	Bundle-Version	4.1.72.Final	High
Version	Manifest	Implementation-Version	4.1.72.Final	High
Version	pom	version	4.1.72.Final	Highest

Related Dependencies

Identifiers

pkg:maven/io.netty/netty-transport@4.1.72.Final (Confidence:High)
cpe:2.3:a:netty:netty:4.1.72:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation, CWE-626 Null Byte Interaction Error (Poison Null Byte), CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv4:

Base Score: HIGH (8.3)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-55163

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.2)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-697 Incorrect Comparison, CWE-1287 Improper Validation of Specified Type of Input, CWE-284 Improper Access Control

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2022-41881

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

CWE-674 Uncontrolled Recursion

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security-advisories@github.com - EXPLOIT,THIRD_PARTY_ADVISORY
security-advisories@github.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.86

CVE-2023-44487

CISA Known Exploited Vulnerability:

Product: IETF HTTP/2
Name: HTTP/2 Rapid Reset Attack Vulnerability
Date Added: 2023-10-10
Description: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-31
Notes: This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487; https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/; https://nvd.nist.gov/vuln/detail/CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CWE-400 Uncontrolled Resource Consumption, NVD-CWE-noinfo

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - THIRD_PARTY_ADVISORY
134c704f-9b21-4f2e-91b3-4a467353bcc0 - US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,MITIGATION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PRESS/MEDIA_COVERAGE
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MITIGATION,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MITIGATION,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MITIGATION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT,RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108 - PRODUCT,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - BROKEN_LINK
cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - ISSUE_TRACKING,MITIGATION,VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PATCH
cve@mitre.org - ISSUE_TRACKING,PRESS/MEDIA_COVERAGE
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING,VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST
cve@mitre.org - MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,PATCH,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST,RELEASE_NOTES,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST,VENDOR_ADVISORY
cve@mitre.org - MAILING_LIST,VENDOR_ADVISORY
cve@mitre.org - MITIGATION,PATCH,VENDOR_ADVISORY
cve@mitre.org - MITIGATION,PATCH,VENDOR_ADVISORY
cve@mitre.org - MITIGATION,VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - PATCH
cve@mitre.org - PATCH
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRESS/MEDIA_COVERAGE,THIRD_PARTY_ADVISORY
cve@mitre.org - PRODUCT
cve@mitre.org - PRODUCT
cve@mitre.org - PRODUCT,RELEASE_NOTES
cve@mitre.org - PRODUCT,THIRD_PARTY_ADVISORY
cve@mitre.org - RELEASE_NOTES
cve@mitre.org - RELEASE_NOTES
cve@mitre.org - RELEASE_NOTES,THIRD_PARTY_ADVISORY
cve@mitre.org - RELEASE_NOTES,VENDOR_ADVISORY
cve@mitre.org - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
cve@mitre.org - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
cve@mitre.org - TECHNICAL_DESCRIPTION,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-703 Improper Check or Handling of Exceptional Conditions, CWE-805 Buffer Access with Incorrect Length Value

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.16

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: HIGH (7.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - NOT_APPLICABLE
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-340 Generation of Predictable Numbers or Identifiers, CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2023-34462

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.94

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-284 Improper Access Control

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:2.8/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2022-24823

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Insecure Permissions, CWE-668 Exposure of Resource to Wrong Sphere

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: LOW (1.9)
Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2024-47535

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.115

CVE-2025-25193

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.118

CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
security-advisories@github.com - EXPLOIT
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.108

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - VENDOR_ADVISORY
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (4.0)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:2.5/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-58056

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - BROKEN_LINK
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0

File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-classes-epoll/4.1.123.Final/netty-transport-classes-epoll-4.1.123.Final.jar
MD5: cf757b6a1a2e932b0afa04f45c65aeb4
SHA1: 5a1ba263146540ffa74910edadf2475454fee927
SHA256:3db30bbaba004f86221bb251168d9bbbd38eecefb42c7802b9cbca628331e156
Referenced In Project/Scope: Grouper Authentication Logic:provided
pkg:maven/edu.internet2.middleware.grouper/grouper@7.0.0-SNAPSHOT

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	netty-transport-classes-epoll	High
Vendor	jar	package name	epoll	Highest
Vendor	jar	package name	io	Highest
Vendor	jar	package name	netty	Highest
Vendor	Manifest	automatic-module-name	io.netty.transport.classes.epoll	Medium
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://netty.io/	Low
Vendor	Manifest	bundle-symbolicname	io.netty.transport-classes-epoll	Medium
Vendor	Manifest	implementation-url	https://netty.io/netty-transport-classes-epoll/	Low
Vendor	Manifest	Implementation-Vendor	The Netty Project	High
Vendor	Manifest	Implementation-Vendor-Id	io.netty	Medium
Vendor	Manifest	specification-vendor	The Netty Project	Low
Vendor	pom	artifactid	netty-transport-classes-epoll	Highest
Vendor	pom	artifactid	netty-transport-classes-epoll	Low
Vendor	pom	groupid	io.netty	Highest
Vendor	pom	name	Netty/Transport/Classes/Epoll	High
Vendor	pom	parent-artifactid	netty-parent	Low
Product	file	name	netty-transport-classes-epoll	High
Product	jar	package name	epoll	Highest
Product	jar	package name	io	Highest
Product	jar	package name	netty	Highest
Product	Manifest	automatic-module-name	io.netty.transport.classes.epoll	Medium
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://netty.io/	Low
Product	Manifest	Bundle-Name	Netty/Transport/Classes/Epoll	Medium
Product	Manifest	bundle-symbolicname	io.netty.transport-classes-epoll	Medium
Product	Manifest	Implementation-Title	Netty/Transport/Classes/Epoll	High
Product	Manifest	implementation-url	https://netty.io/netty-transport-classes-epoll/	Low
Product	Manifest	specification-title	Netty/Transport/Classes/Epoll	Medium
Product	pom	artifactid	netty-transport-classes-epoll	Highest
Product	pom	groupid	io.netty	Highest
Product	pom	name	Netty/Transport/Classes/Epoll	High
Product	pom	parent-artifactid	netty-parent	Medium
Version	Manifest	Bundle-Version	4.1.123.Final	High
Version	Manifest	Implementation-Version	4.1.123.Final	High
Version	pom	version	4.1.123.Final	Highest

Related Dependencies

netty-handler-4.1.123.Final.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-handler/4.1.123.Final/netty-handler-4.1.123.Final.jar
- MD5: 30d74a8080eb3c298e2dad664e060028
- SHA1: ddf6a8d67186c6cec71da202eb13c1d7e7ac85ce
- SHA256: 231e2a2a028aeb91e7a8c4ba3676ff6a3004a1e9a35bcacb394e86ec7f70f5dc
- pkg:maven/io.netty/netty-handler@4.1.123.Final
netty-resolver-4.1.123.Final.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-resolver/4.1.123.Final/netty-resolver-4.1.123.Final.jar
- MD5: b8fcd3d9ab4d180eeefecbc3b87dbc14
- SHA1: 49baab2c943f7c5d9b8f0367a9835008bac55103
- SHA256: fb1fc8f9be939bd551b7162714a7f5ac1e546939580c7c0a55496ae05630f01f
- pkg:maven/io.netty/netty-resolver@4.1.123.Final
netty-transport-classes-kqueue-4.1.123.Final.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-classes-kqueue/4.1.123.Final/netty-transport-classes-kqueue-4.1.123.Final.jar
- MD5: 2cd69d5fa5b7ff75fd315ec891d86076
- SHA1: be6d895cb5828d0df7afd2422e0af5fd70e7ef16
- SHA256: cbb89a86bb6b2368b69a33f9461a1b62dc884946cad43891fc84b1719ca0888a
- pkg:maven/io.netty/netty-transport-classes-kqueue@4.1.123.Final
netty-transport-native-epoll-4.1.123.Final-linux-aarch_64.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-native-epoll/4.1.123.Final/netty-transport-native-epoll-4.1.123.Final-linux-aarch_64.jar
- MD5: 22208fbc509d118f9cb210c62e0b3a83
- SHA1: 0039f83fcf74e473dbc07278cf702a6960832bbd
- SHA256: 0d94e01cbec830e38bc876fcfd415f53777ff721ff113b33fc024dcedf81d94e
- pkg:maven/io.netty/netty-transport-native-epoll@4.1.123.Final
netty-transport-native-epoll-4.1.123.Final-linux-x86_64.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-native-epoll/4.1.123.Final/netty-transport-native-epoll-4.1.123.Final-linux-x86_64.jar
- MD5: 397ba6b1773d427483c7b69319f4bfb9
- SHA1: d81db74b4567903ab051560f3df35d4529b8f1cd
- SHA256: ebea67a93777fe8d4db4f5b23a1aa451aea1aad75a767a40a75306e32f67c9b9
- pkg:maven/io.netty/netty-transport-native-epoll@4.1.123.Final
netty-transport-native-kqueue-4.1.123.Final-osx-aarch_64.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-native-kqueue/4.1.123.Final/netty-transport-native-kqueue-4.1.123.Final-osx-aarch_64.jar
- MD5: acdc52758f3c3ea483ed582165cfd0b4
- SHA1: 804e55c93fd5e0e4f09c9c72b72d3582aae1febb
- SHA256: 535a6f252748b30a75130050865b76ae2ae491b31fe6efb739c513b03ea54cd5
- pkg:maven/io.netty/netty-transport-native-kqueue@4.1.123.Final
netty-transport-native-kqueue-4.1.123.Final-osx-x86_64.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-native-kqueue/4.1.123.Final/netty-transport-native-kqueue-4.1.123.Final-osx-x86_64.jar
- MD5: d369fb471d7682cb70057b25a81f1c55
- SHA1: f271357c2809c732bc8818b680d9daec5471027e
- SHA256: cfb30d05fce20909eaad2951dd07049485e47c7dacd900babbee224c53308e9b
- pkg:maven/io.netty/netty-transport-native-kqueue@4.1.123.Final
netty-transport-native-unix-common-4.1.123.Final.jar
- File Path: /home/grprdist/.m2/repository/io/netty/netty-transport-native-unix-common/4.1.123.Final/netty-transport-native-unix-common-4.1.123.Final.jar
- MD5: 75beb97c34b48bb43f1e8341282275f1
- SHA1: 3bf2e4b900b169419c636685e7d3981d20b904ce
- SHA256: 009b20c26a522633ddc2078e0845f098770648ee9d4bd494beea9955b895856f
- pkg:maven/io.netty/netty-transport-native-unix-common@4.1.123.Final

Identifiers

pkg:maven/io.netty/netty-transport-classes-epoll@4.1.123.Final (Confidence:High)
cpe:2.3:a:netty:netty:4.1.123:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-345 Insufficient Verification of Data Authenticity, CWE-346 Origin Validation Error

CVSSv3:

Base Score: CRITICAL (10.0)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-20 Improper Input Validation, CWE-626 Null Byte Interaction Error (Poison Null Byte), CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-295 Improper Certificate Validation

CVSSv3:

Base Score: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-401 Missing Release of Memory after Effective Lifetime, CWE-1286 Improper Validation of Syntactic Correctness of Input

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv4:

Base Score: HIGH (8.7)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv4:

Base Score: HIGH (8.3)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-55163

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: HIGH (8.2)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-697 Incorrect Comparison, CWE-1287 Improper Validation of Specified Type of Input, CWE-284 Improper Access Control

CVSSv3:

Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-44249] CWE-1287 CWE-284 CWE-697
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-44249
OSSIndex - https://github.com/advisories/GHSA-3qp7-7mw8-wx86
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-703 Improper Check or Handling of Exceptional Conditions, CWE-805 Buffer Access with Incorrect Length Value

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-45416] CWE-770: Allocation of Resources Without Limits or Throttling
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-45416
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-347 Improper Verification of Cryptographic Signature

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-50010] CWE-347: Improper Verification of Cryptographic Signature
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-50010
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions:

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.2.16

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-400 Uncontrolled Resource Consumption, CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - PATCH
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: HIGH (7.1)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:1.8/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - PATCH

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv4:

Base Score: MEDIUM (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - NOT_APPLICABLE
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-340 Generation of Predictable Numbers or Identifiers, CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE-284 Improper Access Control

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:2.8/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - EXPLOIT,MITIGATION,VENDOR_ADVISORY
security-advisories@github.com - EXPLOIT,MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-400 Uncontrolled Resource Consumption

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

134c704f-9b21-4f2e-91b3-4a467353bcc0 - VENDOR_ADVISORY
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-772 Missing Release of Resource after Effective Lifetime

CVSSv3:

Base Score: MEDIUM (4.0)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:2.5/RC:R/MAV:A

References:

OSSINDEX - [CVE-2026-45536] CWE-200: Information Exposure
OSSINDEX - [CVE-2026-45536] CWE-200: Information Exposure
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-45536
OSSIndex - https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - RELEASE_NOTES
security-advisories@github.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2025-58056

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv4:

Base Score: LOW (2.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:N/V:X/RE:X/U:X

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security-advisories@github.com - BROKEN_LINK
security-advisories@github.com - EXPLOIT,VENDOR_ADVISORY
security-advisories@github.com - ISSUE_TRACKING
security-advisories@github.com - ISSUE_TRACKING,PATCH
security-advisories@github.com - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
security-advisories@github.com - PATCH
security-advisories@github.com - TECHNICAL_DESCRIPTION

Vulnerable Software & Versions: (show all)