Homepage

io.netty:netty-codec-haproxy@4.1.134.Final

  • latest version

    4.2.16.Final

  • latest non vulnerable version

    5.0.0.Alpha2

  • first published

    12 years ago

  • latest version published

    24 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.netty:netty-codec-haproxy package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    CRLF Injection

    Affected versions of this package are vulnerable to CRLF Injection via the encodeV1. An attacker can inject arbitrary CRLF sequences into AF_UNIX addresses by supplying specially crafted input, resulting in the creation of multiple PROXY protocol header lines. This can lead to client IP spoofing or manipulation of downstream server behavior by injecting unauthorized PROXY headers.

    Note: This is only exploitable if user-controlled input is used as the AF_UNIX address in the construction of HAProxy V1 protocol headers and the encoded header is sent to a downstream server or load balancer.

    How to fix CRLF Injection?

    Upgrade io.netty:netty-codec-haproxy to version 4.1.136.Final, 4.2.16.Final or higher.

    [,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
    • H
    Allocation of Resources Without Limits or Throttling

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which collides with the decoder's sentinel value and leads to continuous accumulation of inbound bytes until memory is exhausted.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade io.netty:netty-codec-haproxy to version 4.1.136.Final, 4.2.16.Final or higher.

    [4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
    • H
    Missing Release of Memory after Effective Lifetime

    Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the parsing process of nested PP2_TYPE_SSL TLVs within the HAProxy PROXY protocol v2 codec. An attacker can cause memory exhaustion by sending syntactically valid headers containing deeply nested PP2_TYPE_SSL TLVs, which leads to a memory leak as the underlying buffer remains pinned.

    How to fix Missing Release of Memory after Effective Lifetime?

    Upgrade io.netty:netty-codec-haproxy to version 4.1.135.Final, 4.2.15.Final or higher.

    [,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
    • H
    Missing Release of Resource after Effective Lifetime

    Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through improper handling of TLV length in the readNextTLV function. An attacker can cause resource exhaustion and denial of service by sending a specially crafted HAProxy protocol message with a TLV length below the required minimum, leading to an unreleased retained slice and eventual memory leak.

    How to fix Missing Release of Resource after Effective Lifetime?

    Upgrade io.netty:netty-codec-haproxy to version 4.1.135.Final, 4.2.15.Final or higher.

    [,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
    Go back to all versions of this package