io.netty:netty-handler@4.0.30.Final

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch through the OpenSSL client path in ReferenceCountedOpenSslClientContext and related OpenSSL SSL context handling. An attacker can present a certificate for a different hostname and have the connection accepted by a client using SslProvider.OPENSSL with a plain X509TrustManager. When hostname verification is requested on that OpenSSL client path, the connection proceeds without enforcing the peer hostname check, allowing man-in-the-middle interception of TLS traffic. This affects applications that rely on Netty’s OpenSSL provider for outbound TLS connections and leaves users exposed to impersonation and data disclosure.

Upgrade io.netty:netty-handler to version 4.1.137.Final, 4.2.17.Final or higher.

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions through the SslClientHelloHandler.decode ClientHello parser in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java. An attacker can bypass per-SNI mTLS selection by sending a fragmented TLS ClientHello whose 4-byte handshake header spans multiple records, causing parsing to fail and the connection to fall back to the default SslContext. This breaks deployments that rely on SNI-driven SslContext selection as the only client-certificate check: the request reaches the default TLS configuration instead of the intended SNI-specific context, allowing an unauthenticated client to complete a connection where mTLS was expected.

Upgrade io.netty:netty-handler to version 4.2.17.Final, 4.1.137.Final or higher.

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in engineGetTrustManagers() and related methods. An attacker can intercept network traffic by providing a malicious X509TrustManager, which bypasses hostname verification during TLS connections.

Upgrade io.netty:netty-handler to version 4.1.135.Final, 4.2.15.Final or higher.

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Incorrect Comparison in the IpSubnetFilterRule.compareTo() function. An attacker can gain unauthorized access by bypassing IPv6 subnet restrictions through incorrect masking of IP addresses.

Upgrade io.netty:netty-handler to version 4.1.135.Final, 4.2.15.Final or higher.

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SslClientHelloHandler.decode() function. An attacker can cause excessive memory allocation by sending a specially crafted TLS handshake with a large handshake length value, leading to resource exhaustion and potential denial of service.

Upgrade io.netty:netty-handler to version 4.1.135.Final, 4.2.15.Final or higher.

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Denial of Service (DoS) such that if the user has no idle timeout handler configured it might be possible for a remote peer to send a client hello packet which leads the server to buffer up to 16MB of data per connection.

The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record.

Note:

An attacker can craft a packet that makes the SslClientHelloHandler to:

1. Allocate a 16MB ByteBuf.

2. Not fail decode method in buffer.

3. Get out of the loop without an exception.

The combination of this without the use of a timeout makes it easy to connect to a TCP server and allocate 16MB of heap memory per connection.

Upgrade io.netty:netty-handler to version 4.1.94.Final or higher.

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Information Disclosure via the AbstractDiskHttpData method, and on Unix-like systems.

When netty's multipart decoders are used, local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk are enabled. On unix-like systems, the temporary directory is shared between all users. As such, writing to this directory using API's that do not explicitly set the file/directory permissions can lead to information disclosure. The method File.createTempFile on unix-like systems creates a random file, but, by default will create this file with the permissions -rw-r--r--. Sensitive information is written to this file in AbstractDiskHttpData, and other local users can read it.

Upgrade io.netty:netty-handler to version 4.1.59.Final or higher.

io.netty:netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients.

Affected version of this package did not properly ensure that the certificate is actually associated with that host.

Upgrade netty to versions 4.0.45, 4.1.9 or higher.