Skip to content
OpenAdvisories
High USN-6049-1 9 CVEs

netty vulnerabilities

Published Apr 28, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)

It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)

It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2021-21295,
CVE-2021-21409)

It was discovered that Netty's Bzip2 decompression decoder did not limit
the decompressed output data size. A remote attacker could possibly use
this issue to cause Netty to exhaust memory via malicious input, leading
to a denial of service. This issue only affected Ubuntu 18.04 ESM, Ubuntu
20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-37136)

It was discovered that Netty's Snappy frame decoder function did not limit
chunk lengths. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. (CVE-2021-37137)

It was discovered that Netty did not properly handle control chars at the
beginning and end of header names. A remote attacker could possibly use
this issue to smuggle requests. This issue only affected Ubuntu 18.04 ESM,
Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-43797)

It was discovered that Netty could be made into an infinite recursion when
parsing a malformed crafted message. A remote attacker could possibly use
this issue to cause Netty to crash, leading to a denial of service. This
issue only affected Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10.
(CVE-2022-41881)

It was discovered that Netty did not validate header values under certain
circumstances. A remote attacker could possibly use this issue to perform
HTTP response splitting via malicious header values. This issue only
affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu
22.10. (CVE-2022-41915)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS netty 1:4.1.48-4+deb11u1build0.22.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS netty 1:4.0.34-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS netty 1:4.1.7-4ubuntu0.1+esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS netty 1:4.1.45-1ubuntu0.1~esm1

Vulnerabilities 9

  • High 7.5
    CVE-2020-11612

    Denial of Service in Netty

    The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to …

    netty netty io.netty:netty-handler Debian Ubuntu Maven
  • High 7.5
    CVE-2021-37136

    Bzip2Decoder doesn't allow setting size restrictions for decompressed data

    The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…

    The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2021-37137

    SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way

    The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…

    The Netty project Netty druid netty Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2021-43797

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.5
    CVE-2022-41915

    Netty vulnerable to HTTP Response splitting from assigning header value iterator

    Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing ma…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.2
    CVE-2021-21290

    Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.9
    CVE-2021-21295 EPSS 19%

    Possible request smuggling in HTTP/2 due missing validation

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…

    netty io.netty:netty-codec-http2 netty netty Debian Ubuntu Maven
  • Medium 5.9
    CVE-2021-21409

    Possible request smuggling in HTTP/2 due missing validation of content-length

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.3
    CVE-2022-41881

    HAProxyMessageDecoder Stack Exhaustion DoS

    Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

    netty netty netty netty Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2020-11612
  • report
    https://ubuntu.com/security/CVE-2021-21290
  • report
    https://ubuntu.com/security/CVE-2021-21295
  • report
    https://ubuntu.com/security/CVE-2021-21409
  • report
    https://ubuntu.com/security/CVE-2021-37136
  • report
    https://ubuntu.com/security/CVE-2021-37137
  • report
    https://ubuntu.com/security/CVE-2021-43797
  • report
    https://ubuntu.com/security/CVE-2022-41881
  • report
    https://ubuntu.com/security/CVE-2022-41915