Description
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netty | netty | 4.1.86.Final – < 4.1.86.Final, 4.1.83.Final – < 4.1.83.Final* | 4.1.86.Final |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.48-6 | — |
| Debian 13 | netty | 1:4.1.48-6 | — |
| Debian 12 | netty | 1:4.1.48-6 | — |
| Debian 11 | netty | 1:4.1.48-4+deb11u1 | DSA-5316-1 |
| Debian 10 | netty | 1:4.1.33-1+deb10u3 | DLA-3268-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | USN-6049-1 |
| Ubuntu 18.04 LTS | netty-3.9 | No fix yet | — |
| Ubuntu 16.04 LTS | netty-3.9 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | netty | 1:4.1.45-1ubuntu0.1~esm1 | USN-6049-1 |
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm2 | USN-6049-1 |
| Ubuntu Pro 16.04 LTS | netty | 1:4.0.34-1ubuntu0.1~esm1 | USN-6049-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | netty | 4.1.90-150200.4.14.1 | SUSE-SU-2023:2096-2 |
| SLES 15 SP5 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-2 |
| SLES 15 SP4 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SLES 15 SP3 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SLES 15 SP2 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SLES for SAP 15 SP2 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SLE Real Time 15 SP3 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SLE HPC 15 SP3 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SLE HPC 15 SP2 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SUSE Enterprise Storage 7.1 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
| SUSE Enterprise Storage 7 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.114-1.1 | openSUSE-SU-2024:14442-1 |
| openSUSE Leap 15.5 | netty | 4.1.90-150200.4.14.1 | SUSE-SU-2023:2096-2 |
| openSUSE Leap 15.5 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-2 |
| openSUSE Leap 15.4 | netty | 4.1.90-150200.4.14.1 | SUSE-SU-2023:2096-1 |
| openSUSE Leap 15.4 | netty-tcnative | 2.0.59-150200.3.10.1 | SUSE-SU-2023:2096-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty-codec-http | >= 4.1.83.Final, < 4.1.86.Final | 4.1.86.Final | GHSA-hh82-3pmq-7frp |
Advisories 13
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6049-1 netty vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5316-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3268-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:2096-1 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2096-2 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14442-1 netty-4.1.114-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
- WID-SEC-2024-3529 IBM SPSS (Netty): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2024-0519 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2023-1813 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-0783 IBM Tivoli Netcool/OMNIbus: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jun 29, 2023
- WID-SEC-2023-0091 NetApp ActiveIQ Unified Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 12, 2023
References
- https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp
- https://github.com/netty/netty/issues/13084
- https://github.com/netty/netty/pull/12760
- https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4
- [debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update mailing-list
- DSA-5316 vendor-advisory
- https://security.netapp.com/advisory/ntap-20230113-0004/