CVE-2021-37137

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

Denial Of Service(DoS)

netty-codec is vulnerable to denial of service. The vulnerability exists due to lack of allocation size restriction on the decompressed output data in the Snappy frame decoder function, leading to an OOME...

Denial Of Service(DoS)

netty-codec is vulnerable to denial of service. The vulnerability exists due to lack of allocation size restriction on the decompressed output data in the Bzip2 decompression decoder function, leading to an OOME...

africa.absa:inception-application (>=1.0.0, <=1.0.1), ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12) +26890 more potentially affected by CVE-2021-37136 via io.netty:netty-codec (>=4.0.0.alpha1, <=4.1.67.final)

io.netty:netty-codec MAVEN version =4.0.0.alpha1, =1.0.0, =1.4.6, =0.0.1, =0.0.1, =0.5.0, =0.0.1, =0.0.14, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =1.4.1 and more...

HTTP Request Smuggling

netty-codec-http2 is vulnerable to HTTP request smuggling. The vulnerability exists through an incomplete fix in CVE-2021-21295 where the content-length header is not properly validated if the request uses a single Http2HeaderFrame, and with endStream set to true...

CVE-2021-21409

The CVE concerns Netty’s HTTP/2 codec (io.netty:netty-codec-http2) where, before version 4.1.61.Final, a Content-Length check can be bypassed when a single Http2HeaderFrame with endStream set to true is used. This enables HTTP request smuggling if the request is proxied and translated to HTTP/1.1...

CVE-2021-21409: Inconsistent Interpretation of HTTP Requests

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.clarity.codeartifact:ai.clarity.codeartifact.gradle.plugin (>=0.0.1, <=0.0.10) +10652 more potentially affected by CVE-2021-21295 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.59.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =1.4.6, =0.0.1, =0.0.1, =0.5.0, =0.0.1, =0.0.14, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

CVE-2021-21295: Inconsistent Interpretation of HTTP Requests

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a...

Information Disclosure

netty-codec-http is vulnerable to information disclosure. When netty's multipart decoders are used, local files containing confidential information can be accessed via the local system temporary directory if temporary storing uploads on the disk is enabled...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.clarity.codeartifact:ai.clarity.codeartifact.gradle.plugin (>=0.0.1, <=0.0.10) +17002 more potentially affected by CVE-2021-21290 +1 more via io.netty:netty-codec-http (>=4.0.0.final, <=4.1.58.final)

io.netty:netty-codec-http MAVEN version =4.0.0.final, =1.4.6, =0.0.1, =0.0.1, =0.5.0, =0.0.1, =0.0.14, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.clarity.codeartifact:ai.clarity.codeartifact.gradle.plugin (>=0.0.1, <=0.0.10) +17002 more potentially affected by CVE-2021-21290 via io.netty:netty-codec-http (>=4.0.0.final, <=4.1.58.final)

io.netty:netty-codec-http MAVEN version =4.0.0.final, =1.4.6, =0.0.1, =0.0.1, =0.5.0, =0.0.1, =0.0.14, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

PT-2021-7977

Name of the Vulnerable Software and Affected Versions io.netty:netty-codec-http versions prior to 4.1.77.Final Description The issue is related to insufficient fix for a vulnerability in Netty's multipart decoders, which can lead to local information disclosure via the local system temporary...

PT-2021-5814

Name of the Vulnerable Software and Affected Versions io.netty:netty-codec-http2 versions prior to 4.1.60.Final Description The issue is related to the handling of HTTP/2 requests in the Netty framework, specifically when the Content-Length header is present. If a request comes in as an HTTP/2...

Low: Red Hat Security Advisory: AMQ Clients 2.7.0 Release

An update is now available for Red Hat AMQ Clients 2.7.0. Red Hat Product Security has rated this update as having a Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Denial Of Service (DoS)

netty-codec is vulnerable to denial of service DoS. The vulnerability exists as it was possible to send a large data for compression, causing large buffer allocation sizes in the client JVM...

PT-2020-6587

Name of the Vulnerable Software and Affected Versions io.netty:netty-codec-http2 versions prior to 4.1.61.Final Description The issue is related to a lack of proper validation of the content-length header in HTTP/2 requests. If a request only uses a single Http2HeaderFrame with the endStream set ...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.eloquent:theseus (0.3.0) +11380 more potentially affected by CVE-2019-20444 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.43.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =1.4.6, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

HTTP Request Smuggling

netty-codec-http is vulnerable to HTTP request smuggling. The vulnerability exists as it improperly handles whitespaces in the Transfer-Encoding, and the Content-Length headers. This vulnerability is caused by an incomplete fix for CVE-2019-16869...

HTTP Request Smuggling

netty-codec-http is vulnerable to HTTP request smuggling. The library does not properly validate duplicate Content-Length header fields and the Transport-Encoding headers, allowing a remote attacker to smuggle HTTP request by submitting a malicious Transport-Encoding header...