Lack of data validation In io.netty:netty-codec-http
Description
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the URI. Any application / framework using HttpRequestEncoder can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 4.2.8.final, 4.1.129.final | ||
 debian 11 | 1:4.1.48-4+deb11u3 | ||
debian 12 | 1:4.1.48-7+deb12u2 | ||
debian 13 | 1:4.1.48-10+deb13u1 | ||
debian 14 | 1:4.1.48-16 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2.