CVE-2022-24823 — Local Information Disclosure Vulnerability in io.netty:netty-codec-http

Description

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

Affected products

Vendor	Product	Affected	Fixed
netty	netty	<= 4.1.76.Final	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	netty	No fix yet	—
Debian 13	netty	No fix yet	—
Debian 12	netty	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	netty	No fix yet	—
Ubuntu 25.10	netty	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 26.04 LTS	netty	No fix yet	—
Ubuntu Pro 24.04 LTS	netty	1:4.1.48-9ubuntu0.1~esm1	USN-7284-1
Ubuntu Pro 22.04 LTS	netty	1:4.1.48-4+deb11u2ubuntu0.1~esm1	USN-7284-1
Ubuntu Pro 20.04 LTS	netty	1:4.1.45-1ubuntu0.1~esm2	USN-7284-1
Ubuntu Pro 18.04 LTS	netty	1:4.1.7-4ubuntu0.1+esm3	USN-7284-1
Ubuntu Pro 16.04 LTS	netty	1:4.0.34-1ubuntu0.1~esm2	USN-7284-1
Ubuntu Pro 14.04 LTS	netty	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7 +1	1-18.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-FastInfoset +1	1.2.13-11.1.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.16.0-9.redhat_00042.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-activemq-artemis-native	1:1.0.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-aesh-extensions	1.8.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-aesh-readline	2.2.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-agroal +3	1.3.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-antlr	2.7.7-54.redhat_7.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-beanutils	1.9.4-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-codec	1.15.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-collections	3.2.2-9.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-io	2.10.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-lang	3.11.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-lang2	2.6.0-1.redhat_7.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.3.13-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-mime4j	0.6.0-4.1.redhat_7.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-sshd	2.7.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-artemis-native +1	1:1.0.2-3.redhat_1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-artemis-wildfly-integration	1.0.4-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-atinject	1.0.3-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-avro	1.7.6-7.1.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-azure-storage	8.6.6-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-bouncycastle +4	1.68.0-2.redhat_00005.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-byte-buddy	1.11.12-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-caffeine	2.8.8-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-cal10n	0.8.1-6.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-codehaus-jackson +4	1.9.13-10.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-commons-logging-jboss-logging	1.0.0-1.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-cryptacular	1.2.4-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-cxf-xjc-dv +5	3.3.1-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-ecj	1:3.26.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-eclipse-jgit	5.13.0.202109080827-1.r_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.9.2-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-fge-btf	1.2.0-1.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-fge-msg-simple	1.1.0-1.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-concurrent	1.1.1-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-jaf	1.2.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-javamail	1.6.5-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.14-4.SP05_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-json	1.1.6-2.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-gnu-getopt	1.0.13-6.redhat_5.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-gson	2.8.9-1.redhat_00001.1.el7eap	RHSA-2022:5894, RHSA-2022:5893, RHSA-2022:5892
Red Hat JBoss EAP 7	eap7-guava +1	30.1.0-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-guava-failureaccess	1.0.1-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-h2database	1.4.197-2.redhat_00004.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hal-console	3.3.13-1.Final_redhat_00001.1.el7eap	RHSA-2022:5894, RHSA-2022:5893, RHSA-2022:5892
Red Hat JBoss EAP 7	eap7-hibernate +2	5.3.27-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-beanvalidation-api	2.0.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-commons-annotations	5.0.5-1.1.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-search +5	5.10.7-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.23-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hornetq +3	2.4.8-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-httpcomponents-asyncclient	4.1.4-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-httpcomponents-client	4.5.13-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-httpcomponents-core	4.4.14-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-infinispan +9	11.0.15-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.5.3-2.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.12.6-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jackson-coreutils	1.8.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jackson-databind	2.12.6.1-2.redhat_00004.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jakarta-el	3.0.3-3.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jakarta-security-enterprise-api	1.0.2-3.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jandex	2.4.2-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jansi	1.18.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jasypt	1.9.3-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-java-classmate	1.5.1-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javaee-jpa-spec	2.2.3-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javaee-security-soteria +1	1.0.1-3.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javaewah	1.1.7-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javapackages-tools +1	3.4.1-5.15.6.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javassist	3.27.0-2.GA_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jaxbintros	1.0.3-1.GA_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jaxen	1.1.6-14.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jberet +1	1.3.9-2.SP2_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-aesh	2.4.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-classfilewriter	1.2.5-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-common-beans +2	2.0.1-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-dmr	1.5.1-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-ejb-api_3.2_spec +7	2.0.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.44-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-ejb3-ext-api	2.3.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-el-api_3.0_spec +4	2.0.0-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-iiop-client +1	1.0.1-3.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-interceptors-api_1.2_spec	2.0.0-3.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-invocation	1.6.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-jaspi-api_1.1_spec +1	2.0.1-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	3.0.0-5.SP06_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-logging	3.4.1-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.18-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-marshalling +1	2.0.12-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-metadata +5	13.0.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-modules	1.12.0-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-msc	1.4.12-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-openjdk-orb	8.1.4-3.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.25-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-remoting-jmx	3.0.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-saaj-api_1.3_spec	1.0.6-1.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-saaj-api_1.4_spec	1.0.2-1.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-seam-int	7.0.0-6.GA_redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-security-negotiation	3.0.6-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-security-xacml	2.0.8-17.Final_redhat_8.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-server-migration +2	1.10.0-18.Final_redhat_00017.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-stdio +1	1.1.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-threads	2.4.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-transaction-api_1.3_spec	2.0.0-4.Final_redhat_00005.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-transaction-spi	7.6.0-2.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-vfs	3.2.16-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-weld-3.1-api +2	3.1.0-6.SP3_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.8.7-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-api	1.1.2-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-common	3.3.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-common-tools	1.3.2-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-cxf	5.4.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-spi	3.3.1-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jcip-annotations	1.0.0-5.redhat_8.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jctools +1	2.1.2-1.redhat_00003.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jettison +1	1.4.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jgroups	4.2.15-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jgroups-azure	1.3.1-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jgroups-kubernetes	1.0.16-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-joda-time	2.9.7-2.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-json-patch	1.9.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jsonb-spec	1.0.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jsoup	1.14.2-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jul-to-slf4j-stub	1.0.1-7.Final_redhat_3.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-log4j	2.17.1-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-log4j-jboss-logmanager	1.2.2-1.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-log4j2-jboss-logmanager	1.0.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-lucene-core +7	5.5.5-3.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-mod_cluster	1.4.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-mustache-java +1	0.9.6-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-narayana +10	5.11.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-neethi	3.1.1-1.1.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-netty +27	4.1.77-1.Final_redhat_00001.1.el7eap	RHSA-2022:5894, RHSA-2022:5893, RHSA-2022:5892
Red Hat JBoss EAP 7	eap7-netty-tcnative	2.0.52-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-netty-transport-native-epoll	4.1.77-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-netty-xnio-transport	0.1.9-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-objectweb-asm	9.1.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-opensaml +13	3.3.1-1.1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketbox +1	5.0.3-10.Final_redhat_00009.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketbox-commons	1.0.0-4.final_redhat_5.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketlink-api +7	2.5.5-21.SP12_redhat_00011.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketlink-bindings +1	2.5.5-26.SP12_redhat_00014.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-protostream	4.3.5-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-reactive-streams	1.0.3-2.redhat_00003.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-reactivex-rxjava	3.0.9-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-reactivex-rxjava2	2.2.20-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-resteasy +18	3.15.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-shibboleth-java-support	7.3.0-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-slf4j +2	1.7.22-4.1.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-snakeyaml	1.29.0-1.redhat_00001.2.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-stax-ex	1.8.3-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-stax2-api	4.2.1-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-staxmapper	1.3.0-2.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-istack-commons +2	3.0.10-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-saaj-1.3-impl	1.3.16-18.SP1_redhat_6.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-saaj-1.4-impl	1.4.1-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-ws-metadata-2.0-api	1.0.0-7.MR1_redhat_8.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-taglibs-standard-impl +3	1.2.6-2.1.RC1_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-txw2 +7	2.3.3-4.1.b02_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-undertow	2.2.18-2.SP2_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-undertow-jastow +1	2.0.9-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-undertow-js	1.0.2-2.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-vdx +2	1.1.6-2.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-velocity +1	2.3.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-weld-cdi-2.0-api	2.0.2-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.1.6-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly +2	7.4.6-5.GA_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-client-config	1.0.1-2.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.4-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-discovery +1	1.2.1-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-elytron +1	1.15.13-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.1.12-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.14-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-openssl	2.2.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP5	netty	4.1.90-150200.4.14.1	SUSE-SU-2023:2096-2
SLES 15 SP5	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-2
SLES 15 SP4	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SLES 15 SP3	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SLES 15 SP2	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP3	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SLES for SAP 15 SP2	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SLE Real Time 15 SP3	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SLE HPC 15 SP3	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SLE HPC 15 SP2	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SUSE Enterprise Storage 7.1	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1
SUSE Enterprise Storage 7	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	netty	4.1.114-1.1	openSUSE-SU-2024:14442-1
openSUSE Leap 15.5	netty	4.1.90-150200.4.14.1	SUSE-SU-2023:2096-2
openSUSE Leap 15.5	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-2
openSUSE Leap 15.4	netty	4.1.90-150200.4.14.1	SUSE-SU-2023:2096-1
openSUSE Leap 15.4	netty-tcnative	2.0.59-150200.3.10.1	SUSE-SU-2023:2096-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.netty:netty-codec-http	< 4.1.77.Final	4.1.77.Final	GHSA-269q-hmxg-m83q

Advisories 17

RHSA-2022:5894 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update. Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5892 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5893 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
USN-7284-1 netty vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
SUSE-SU-2023:2096-1 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:2096-2 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-2133 JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten BSI CERT-Bund (WID) · Nov 18, 2025
WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
openSUSE-SU-2024:14442-1 netty-4.1.114-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
WID-SEC-2022-0901 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 4, 2025
WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
WID-SEC-2022-0508 IBM Tivoli Netcool/OMNIbus: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Sep 7, 2023
WID-SEC-2023-0027 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2023
WID-SEC-2023-0133 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023

CNA	v3.1	5.5
EUVD	v3.1	5.5
OSV:GHSA	v3.1	5.5

Local Information Disclosure Vulnerability in io.netty:netty-codec-http

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

SUSE

openSUSE

Affected packages

Advisories 17

References