io.netty:netty-codec-http 4.1.135.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-codec-http package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M HTTP Request Smuggling io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket handshake. An attacker can bypass expected header validation by sending a `Sec-WebSocket-Version: 7` header while omitting the `Connection: Upgrade` and `Upgrade: websocket` headers, which may result in a protocol switch that is not recognized by intermediary proxies, potentially enabling HTTP request smuggling or protocol confusion attacks. How to fix HTTP Request Smuggling? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
M Allocation of Resources Without Limits or Throttling io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `HttpContentEncoder`. An attacker can cause unbounded memory consumption by sending a large number of HTTP/1.1 pipelined requests faster than the application can generate responses, leading to resource exhaustion. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
H Allocation of Resources Without Limits or Throttling io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the processing of SPDY SETTINGS frames in the `SpdyFrameCodec.decode` function. An attacker can cause excessive memory allocation and CPU consumption by sending a specially crafted SETTINGS frame with a large number of unique setting IDs, leading to resource exhaustion on the target system. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
M CRLF Injection io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to CRLF Injection in the `HttpPostRequestEncoder`. An attacker can inject arbitrary MIME headers and manipulate multipart request bodies by supplying crafted filenames containing CRLF sequences. This can lead to overriding Content-Type headers, injecting malicious scripts, or altering form data processed by downstream services. Note: This is only exploitable if the application uses the multipart encoder with filenames derived from user-controlled input and does not perform its own CRLF sanitization. How to fix CRLF Injection? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
H Allocation of Resources Without Limits or Throttling io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `SpdyHttpDecoder`. An attacker can cause native memory exhaustion by sending a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` followed by a `RST_STREAM` frame or by exceeding the maximum content length, which leads to unreleased pooled `ByteBuf` allocations. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
M Incorrect Authorization io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Incorrect Authorization in the `CorsHandler`. An attacker can gain unauthorized access to backend resources by sending requests with an `Origin: null` header, which bypasses the intended access controls due to a logical operator error in the origin evaluation. How to fix Incorrect Authorization? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
H Allocation of Resources Without Limits or Throttling io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `SpdyFrameCodec` pipeline. An attacker can exhaust system resources by sending a small compressed `HEADERS` block that expands into significantly larger raw header data, leading to excessive CPU and memory allocation. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-http` to version 4.1.136.Final, 4.2.16.Final or higher.	[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Vulnerability

Vulnerable Version

HTTP Request Smuggling

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket handshake. An attacker can bypass expected header validation by sending a Sec-WebSocket-Version: 7 header while omitting the Connection: Upgrade and Upgrade: websocket headers, which may result in a protocol switch that is not recognized by intermediary proxies, potentially enabling HTTP request smuggling or protocol confusion attacks.

How to fix HTTP Request Smuggling?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the HttpContentEncoder. An attacker can cause unbounded memory consumption by sending a large number of HTTP/1.1 pipelined requests faster than the application can generate responses, leading to resource exhaustion.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the processing of SPDY SETTINGS frames in the SpdyFrameCodec.decode function. An attacker can cause excessive memory allocation and CPU consumption by sending a specially crafted SETTINGS frame with a large number of unique setting IDs, leading to resource exhaustion on the target system.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

CRLF Injection

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to CRLF Injection in the HttpPostRequestEncoder. An attacker can inject arbitrary MIME headers and manipulate multipart request bodies by supplying crafted filenames containing CRLF sequences. This can lead to overriding Content-Type headers, injecting malicious scripts, or altering form data processed by downstream services.

Note: This is only exploitable if the application uses the multipart encoder with filenames derived from user-controlled input and does not perform its own CRLF sanitization.

How to fix CRLF Injection?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SpdyHttpDecoder. An attacker can cause native memory exhaustion by sending a client-initiated SYN_STREAM frame with FLAG_FIN=0 followed by a RST_STREAM frame or by exceeding the maximum content length, which leads to unreleased pooled ByteBuf allocations.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Incorrect Authorization

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Incorrect Authorization in the CorsHandler. An attacker can gain unauthorized access to backend resources by sending requests with an Origin: null header, which bypasses the intended access controls due to a logical operator error in the origin evaluation.

How to fix Incorrect Authorization?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the SpdyFrameCodec pipeline. An attacker can exhaust system resources by sending a small compressed HEADERS block that expands into significantly larger raw header data, leading to excessive CPU and memory allocation.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.

[4.1.0.Final,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

io.netty:netty-codec-http@4.1.135.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically