CVE-2014-0193 — Netty denial of service vulnerability

Description

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 8	netty-3.9	3.9.0.Final-1+deb8u1	DLA-2110-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 6	apache-commons-beanutils-eap6	1.8.3-7.redhat_6.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-cli-eap6	1.2-6.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-codec-eap6	1.4-16.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-collections-eap6	3.2.1-15.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-configuration-eap6	1.6-1.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-daemon-jsvc-eap6	1:1.0.15-6.redhat_2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-io-eap6	2.1-8.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-lang-eap6	2.6-8.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-mime4j	0.6-10.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	cal10n-eap6	0.7.3-2.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-7.redhat_3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	ecj-eap6	4.3.1-3.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	glassfish-jaf	1.1.1-16.redhat_2.ep6.el6	RHSA-2014:1020
Red Hat JBoss EAP 6	glassfish-jaxb-eap6	2.2.5-20.redhat_8.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	gnu-getopt-eap6	1.0.13-1.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	guava-libraries	13.0.1-3.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	h2database	1.3.168-7.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hibernate4-eap6 +4	4.2.14-2.SP1_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hibernate4-validator	4.3.1-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hornetq	2.3.20-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hornetq-native +1	2.3.20-2.Final_redhat_1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	httpcomponents-eap6 +1	6-10.redhat_1.3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	httpcore-eap6 +4	4.2.1-10.redhat_1.3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	httpd +3	2.2.26-35.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	infinispan +4	5.2.10-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.26-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jandex-eap6	1.0.3-3.Final_redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jansi-eap6	1.9-2.redhat_4.3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jaxbintros	1.0.2-17.GA_redhat_6.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jaxen-eap6	1.1.3-2.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-as-ee +50	7.4.0-13.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-as-security +1	7.4.0-14.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-genericjms	1.0.5-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-hal +1	2.2.8-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-jaxws-api_2.2_spec	2.0.2-4.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec	1.0.1-8.Final_redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-jstl-api_1.2_spec	1.0.6-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-logging	3.1.4-1.GA_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-marshalling	1.4.6-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-metadata +5	7.1.0-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-msc	1.1.5-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-remoting3	3.3.1-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-saaj-api_1.3_spec	1.0.3-3.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-sasl	1.0.4-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-security-negotiation	2.3.3-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-transaction-api_1.1_spec	1.0.1-10.Final_redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-transaction-spi	7.1.0-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-vfs2	3.2.5-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-core	7.4.0-16.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-domain +4	7.4.0-15.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-javadocs	7.4.0-20.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-modules-eap	7.4.0-38.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-product-eap	7.4.0-19.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-welcome-content-eap	7.4.0-17.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossts	1:4.17.21-2.Final_redhat_2.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossweb	7.4.8-4.Final_redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-common	2.3.0-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-cxf	4.3.0-3.Final_redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-native	4.2.0-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-spi	2.3.0-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jdom-eap6	1.1.2-6.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jettison-eap6	1.3.1-3.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jgroups	1:3.2.13-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	joda-time-eap6	1.6.2-1.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jython-eap6	2.5.2-6.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_cluster +1	1.2.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_cluster-native	1.2.9-3.Final_redhat_2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_jk +1	1.2.40-2.redhat_1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_rt	2.4.1-3.GA.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_snmp	2.4.1-7.GA.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_ssl	1:2.2.26-35.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	netty	3.6.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	opensaml	2.5.3-4.redhat_2.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	openws	1.4.4-3.redhat_2.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	picketlink-bindings	2.5.3-8.SP10_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	picketlink-federation	2.5.3-9.SP10_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	resteasy	2.3.8-4.Final_redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	rngom-eap6	201103-2.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	scannotation	1.0.3-6.redhat_4.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	slf4j +1	1.7.2-13.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	slf4j-jboss-logmanager	1.0.3-1.GA_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	snakeyaml-eap6	1.8-1.redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	stilts	0.1.26-13.redhat_4.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-codemodel	2.6-4.redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-istack-commons	1:2.6.1-10.redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-saaj-1.3-impl	1.3.16-9.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-txw2	20110809-7.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-xsom	20110809-7.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	tomcat-native +1	1.1.30-2.redhat_1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	weld-core	1.1.23-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	woodstox-core-eap6	4.2.0-12.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	woodstox-stax2-api-eap6	3.1.3-3.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	ws-commons-neethi	3.0.2-8.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	wsdl4j-eap6	1.6.3-1.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	xml-commons-resolver-eap6	1.2-17.redhat_9.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	xmltooling	1.3.4-6.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	xom	1.2.7-3.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.netty:netty	>= 3.6.0.Beta1, < 3.6.9.Final	3.6.9.Final	GHSA-7vpq-g998-qpv7
Maven	io.netty:netty	>= 3.7.0.Final, < 3.7.1.Final	3.7.1.Final	GHSA-7vpq-g998-qpv7
Maven	io.netty:netty	>= 3.8.0.Final, < 3.8.2.Final	3.8.2.Final	GHSA-7vpq-g998-qpv7
Maven	io.netty:netty	>= 3.9.0.Final, < 3.9.1.Final	3.9.1.Final	GHSA-7vpq-g998-qpv7
Maven	io.netty:netty	>= 4.0.0.Alpha1, < 4.0.19.Final	4.0.19.Final	GHSA-7vpq-g998-qpv7
Maven	io.netty:netty-all	>= 4.0.0.Alpha1, < 4.0.19.Final	4.0.19.Final	GHSA-7vpq-g998-qpv7

Advisories 4

RHSA-2014:1020 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DLA-2110-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026

References

67182 vdb-entry
RHSA-2015:0765 vendor-advisory
59290 third-party-advisory
RHSA-2015:0675 vendor-advisory
RHSA-2015:0720 vendor-advisory
RHSA-2014:1020 vendor-advisory
RHSA-2014:1021 vendor-advisory
https://github.com/netty/netty/issues/2441
58280 third-party-advisory
RHSA-2014:1019 vendor-advisory
http://netty.io/news/2014/04/30/release-day.html
RHSA-2014:1351 vendor-advisory
[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
[debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update mailing-list