io.netty:netty-codec-haproxy 4.2.15.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-codec-haproxy package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M CRLF Injection Affected versions of this package are vulnerable to CRLF Injection via the `encodeV1`. An attacker can inject arbitrary CRLF sequences into `AF_UNIX` addresses by supplying specially crafted input, resulting in the creation of multiple PROXY protocol header lines. This can lead to client IP spoofing or manipulation of downstream server behavior by injecting unauthorized PROXY headers. Note: This is only exploitable if user-controlled input is used as the `AF_UNIX` address in the construction of HAProxy V1 protocol headers and the encoded header is sent to a downstream server or load balancer. How to fix CRLF Injection? Upgrade `io.netty:netty-codec-haproxy` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `HAProxyMessageDecoder`. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of `0xFF`, which collides with the decoder's sentinel value and leads to continuous accumulation of inbound bytes until memory is exhausted. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-haproxy` to version 4.1.136.Final, 4.2.16.Final or higher.	[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Vulnerability

Vulnerable Version

CRLF Injection

Affected versions of this package are vulnerable to CRLF Injection via the encodeV1. An attacker can inject arbitrary CRLF sequences into AF_UNIX addresses by supplying specially crafted input, resulting in the creation of multiple PROXY protocol header lines. This can lead to client IP spoofing or manipulation of downstream server behavior by injecting unauthorized PROXY headers.

Note: This is only exploitable if user-controlled input is used as the AF_UNIX address in the construction of HAProxy V1 protocol headers and the encoded header is sent to a downstream server or load balancer.

How to fix CRLF Injection?

Upgrade io.netty:netty-codec-haproxy to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which collides with the decoder's sentinel value and leads to continuous accumulation of inbound bytes until memory is exhausted.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-haproxy to version 4.1.136.Final, 4.2.16.Final or higher.

[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

io.netty:netty-codec-haproxy@4.2.15.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically