CVE-2015-2156

🗓️ 18 Oct 2017 15:00:00Reported by MendType

Remote attackers can bypass the httpOnly flag on cookies in Netty or Play Framework 2.x.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Netty affect watsonx.data	3 Sep 202420:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Netty, IBM Operations Analytics - Log Analysis is affected by denial of service, information disclosure, and HTTP request smuggling	6 Apr 202617:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java and IBM WebSphere Application Server Liberty	18 Dec 202409:57	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerable netty classes from couchdb affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	10 Jun 202421:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	22 Dec 202520:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	2 Dec 202121:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.	10 Mar 202121:20	–	ibm
Chainguard	CVE-2015-2156 vulnerabilities	10 Apr 202602:13	–	cgr

Vulners

Node

netty nettyRange3.3.0.Final–3.9.8.Final

netty nettyRange3.10.0.Final–3.10.3.Final

Source	Link
github	www.github.com/netty/netty
lists	www.lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769@%3Ccommits.cassandra.apache.org%3E
playframework	www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
lists	www.lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html
github	www.github.com/netty/netty/commit/31815598a2af37f0b71ea94eada70d6659c23752
nvd	www.nvd.nist.gov/vuln/detail/CVE-2015-2156
github	www.github.com/netty/netty/pull/3754
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
openwall	www.openwall.com/lists/oss-security/2015/05/17/1
securityfocus	www.securityfocus.com/bid/74704

06 Oct 2026 02:35Current

CVSS 3.17.5

CVSS 48.7

CVSS 24.3

CVSS 37.5

EPSS0.05222

CWE-20