Homepage
About Snyk

io.netty:netty-handler@4.1.60.Final vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-handler package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Denial of Service (DoS)

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Denial of Service (DoS) such that if the user has no idle timeout handler configured it might be possible for a remote peer to send a client hello packet which leads the server to buffer up to 16MB of data per connection.

The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record.

Note:

An attacker can craft a packet that makes the SslClientHelloHandler to:

  1. Allocate a 16MB ByteBuf.

  2. Not fail decode method in buffer.

  3. Get out of the loop without an exception.

The combination of this without the use of a timeout makes it easy to connect to a TCP server and allocate 16MB of heap memory per connection.

How to fix Denial of Service (DoS)?

Upgrade io.netty:netty-handler to version 4.1.94.Final or higher.

[,4.1.94.Final)
Go back to all versions of this package