Skip to content
OpenAdvisories

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

Affected products

VendorProductAffectedFixed
netty netty < 4.1.108.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 netty 1:4.1.48-10 —
Debian 13 netty 1:4.1.48-10 —
Debian 12 netty 1:4.1.48-7+deb12u2 —
Debian 11 netty 1:4.1.48-4+deb11u3 DLA-4519-1
Debian 10 netty 1:4.1.33-1+deb10u5 DLA-3834-1
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS netty 1:4.1.48-9ubuntu0.1~esm1 USN-7284-1
Ubuntu Pro 22.04 LTS netty 1:4.1.48-4+deb11u2ubuntu0.1~esm1 USN-7284-1
Ubuntu Pro 20.04 LTS netty 1:4.1.45-1ubuntu0.1~esm2 USN-7284-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS netty 1:4.1.7-4ubuntu0.1+esm3 USN-7284-1
Ubuntu Pro 16.04 LTS netty 1:4.0.34-1ubuntu0.1~esm2 USN-7284-1
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.21.0-5.redhat_00052.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus +1 2.0.3-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.1-3.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-beanutils 1.9.4-13.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-cli 1.4.0-2.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.15.0-6.redhat_00016.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.4-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-mime4j +2 0.8.11-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-sshd 2.12.1-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.78.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-byte-buddy 1.14.18-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-caffeine 3.1.8-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-cxf-xjc-dv +5 4.0.0-5.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.3.0-2.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-1.jre_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hal-console 3.6.19-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hornetq +3 2.4.9-4.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-3.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-client 4.5.14-4.redhat_00012.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-core 4.4.16-4.redhat_00010.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-infinispan +20 14.0.30-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-mail +1 2.1.3-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-servlet-api 6.0.0-5.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-websocket +2 2.1.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jandex 3.0.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jasypt 1.9.3-4.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-java-classmate 1.5.1-3.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.5-2.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.0.0-3.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-openjdk-orb 10.1.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.1.0-1.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-joda-time 2.12.7-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.7-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-mod_cluster 2.0.3-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-neethi 3.2.0-1.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty +14 4.1.108-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-opensaml +13 4.2.0-4.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-parsson 1.1.5-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-resteasy +15 6.2.7-2.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.13-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-stax2-api 4.2.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-velocity +1 2.3.0-3.redhat_00009.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-weld-ejb +6 5.1.2-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly +3 8.0.3-9.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-discovery +1 1.3.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.6-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wsdl4j 1.6.3-5.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wss4j +6 3.0.3-1.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-xml-security 3.0.4-1.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-yasson 3.0.3-3.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 7 eap7-bouncycastle +5 1.78.1-1.redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.17-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jandex 2.4.5-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.29-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-37.Final_redhat_00037.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.16-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-log4j-jboss-logmanager 1.3.1-1.Final_redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty +28 4.1.108-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.18-1.GA_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.18-1.GA_redhat_00001.1.el8eap RHSA-2024:5145, RHSA-2024:5144
ReleasePackageFixed inAdvisory
SLES 15 SP6 netty 4.1.108-150200.4.23.1 SUSE-SU-2024:1079-2
SLES 15 SP6 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-2
SLES 15 SP6 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLES 15 SP5 netty 4.1.108-150200.4.23.1 SUSE-SU-2024:1079-1
SLES 15 SP5 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES 15 SP5 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLES 15 SP4 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES 15 SP4 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLES 15 SP3 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES 15 SP3 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLES 15 SP2 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES 15 SP2 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES for SAP 15 SP4 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLES for SAP 15 SP3 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES for SAP 15 SP3 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLES for SAP 15 SP2 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLES for SAP 15 SP2 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLE HPC 15 SP4 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLE HPC 15 SP4 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLE HPC 15 SP3 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLE HPC 15 SP3 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SLE HPC 15 SP2 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SLE HPC 15 SP2 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
SUSE Enterprise Storage 7.1 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
SUSE Enterprise Storage 7.1 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.114-1.1 openSUSE-SU-2024:14442-1
openSUSE Tumbleweed netty3 3.10.6-17.1 openSUSE-SU-2024:14101-1
openSUSE Leap 15.6 netty 4.1.108-150200.4.23.1 SUSE-SU-2024:1079-2
openSUSE Leap 15.6 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-2
openSUSE Leap 15.6 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1
openSUSE Leap 15.5 netty 4.1.108-150200.4.23.1 SUSE-SU-2024:1079-1
openSUSE Leap 15.5 netty-tcnative 2.0.65-150200.3.19.1 SUSE-SU-2024:1079-1
openSUSE Leap 15.5 netty3 3.10.6-150200.3.10.1 SUSE-SU-2024:2313-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cloudwatch-exporter 0.15.5-r1 —
Wolfi rolling druid 37.0.0-r8 —
Wolfi rolling opensearch-2 2.13.0-r0 —
Wolfi rolling selenium 4.19.0-r0 —
Wolfi rolling sonarqube-10 25.3.0.104237-r0 —
Wolfi rolling tez 0.10.4-r6 —
Wolfi rolling trino-plugin-http-server-event-listener No fix yet —
Wolfi rolling wavefront-proxy +3 13.4-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-http < 4.1.108.Final 4.1.108.Final GHSA-5jpm-x58v-624v

Advisories 43

References