Description
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Netty project | Netty | unspecified – < 4.1.68Final | 4.1.68Final |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.48-6 | — |
| Debian 13 | netty | 1:4.1.48-6 | — |
| Debian 12 | netty | 1:4.1.48-6 | — |
| Debian 11 | netty | 1:4.1.48-4+deb11u1 | DSA-5316-1 |
| Debian 10 | netty | 1:4.1.33-1+deb10u3 | DLA-3268-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | USN-6049-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | netty | 1:4.1.45-1ubuntu0.1~esm1 | USN-6049-1 |
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm2 | USN-6049-1 |
| Ubuntu Pro 16.04 LTS | netty | 1:4.0.34-1ubuntu0.1~esm1 | USN-6049-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | candlepin +1 | 4.1.15-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | foreman +13 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-git | 1.11.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-rails-html-sanitizer | 1.4.3-2.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-glassfish-el +1 | 3.0.1-4.b08_redhat_00005.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hibernate +5 | 5.1.17-3.Final_redhat_00004.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +4 | 2.10.4-3.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-datatype-jdk8 +2 | 2.10.4-2.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-modules-base +1 | 2.10.4-5.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-ejb-client | 4.0.12-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-16.Final_redhat_00017.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-2.Final_redhat_00003.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-16.SP14_redhat_00001.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.11-4.GA_redhat_00002.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.14-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron-tool | 1.10.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-http-client +4 | 1.0.21-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.14-3.GA_redhat_00002.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-naming-client | 1.0.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-openssl +1 | 1.0.12-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-openssl-linux | 1.0.12-6.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-9.redhat_00042.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-h2database | 1.4.197-2.redhat_00004.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.12-1.Final_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.12.6.1-1.redhat_00003.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.7-1.SP1_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-netty +27 | 4.1.72-4.Final_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.17-2.SP4_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.5-3.GA_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.1.11-1.SP1_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
| Red Hat JBoss EAP 7 | eap7-xerces-j2 | 2.12.0-3.SP04_redhat_00001.1.el7eap | RHSA-2022:4919, RHSA-2022:4918 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:8506 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.3 | netty | 4.1.44.Final-150400.3.3.2 | SUSE-SU-2022:3760-1 |
| SUSE Manager Server Module 4.2 | netty | 4.1.44.Final-150300.4.3.2 | SUSE-SU-2022:3617-1 |
| SUSE Manager Server Module 4.1 | netty | 4.1.44.Final-150200.3.4.2 | SUSE-SU-2022:3793-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.114-1.1 | openSUSE-SU-2024:14442-1 |
| openSUSE Leap 15.3 | netty | 4.1.75-150200.4.6.2 | SUSE-SU-2022:1271-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 34.0.0-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty | all versions | — | GHSA-9vjp-v76f-g363 |
| Maven | io.netty:netty-codec | >= 4.0.0, < 4.1.68.Final | 4.1.68.Final | GHSA-9vjp-v76f-g363 |
| Maven | org.jboss.netty:netty | all versions | — | GHSA-9vjp-v76f-g363 |
Advisories 21
- RHSA-2025:9583 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:9582 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2022:8506 Red Hat Security Advisory: Satellite 6.12 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:4919 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:4918 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6049-1 netty vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5316-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3268-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:8506 Important: Satellite 6.12 Release Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:3793-1 Security update for netty SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3760-1 Security update for netty SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3617-1 Security update for netty SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1271-1 Security update for netty SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2022-0097 Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 24, 2025
- openSUSE-SU-2024:14442-1 netty-4.1.114-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3196 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
References
- https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363
- [tinkerpop-dev] 20211025 [jira] [Created] (TINKERPOP-2632) Netty 4.1.61 flagged with two high severity security violations mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211025 [GitHub] [druid] a2l007 commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211026 [GitHub] [druid] clintropolis merged pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211026 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update mailing-list
- DSA-5316 vendor-advisory