netty

49 results · Clear filters · Feed

• Medium 5.3
  CVE-2024-29025

  Netty HttpPostRequestDecoder can OOM

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

  netty netty druid netty Debian Ubuntu Wolfi Maven
  Mar 25, 2024
• Medium 6.5
  CVE-2023-34462

  netty-handler SniHandler 16MB allocation

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

  netty netty netty netty Debian Ubuntu Wolfi Maven
  Jun 22, 2023
• Medium 6.5
  CVE-2022-41915

  Netty vulnerable to HTTP Response splitting from assigning header value iterator

  Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing ma…

  netty netty netty netty Debian Ubuntu Maven
  Dec 13, 2022
• Medium 5.3
  CVE-2022-41881

  HAProxyMessageDecoder Stack Exhaustion DoS

  Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…

  netty netty netty netty Debian Ubuntu Maven
  Dec 12, 2022
• Medium 5.5
  CVE-2022-24823

  Local Information Disclosure Vulnerability in io.netty:netty-codec-http

  Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…

  netty netty netty netty Debian Ubuntu Maven
  May 6, 2022
• Medium 6.5
  CVE-2021-43797

  HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

  netty netty netty netty Debian Ubuntu Maven
  Dec 9, 2021
• Medium 5.9
  CVE-2021-21409

  Possible request smuggling in HTTP/2 due missing validation of content-length

  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…

  netty netty netty netty Debian Ubuntu Maven
  Mar 30, 2021
• Medium 5.9
  CVE-2021-21295 EPSS 19%

  Possible request smuggling in HTTP/2 due missing validation

  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…

  netty io.netty:netty-codec-http2 netty netty Debian Ubuntu Maven
  Mar 9, 2021
• Medium 6.2
  CVE-2021-21290

  Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…

  netty netty netty netty Debian Ubuntu Maven
  Feb 8, 2021