io.netty:netty-handler 4.2.14.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-handler package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in `engineGetTrustManagers()` and related methods. An attacker can intercept network traffic by providing a malicious `X509TrustManager`, which bypasses hostname verification during TLS connections. How to fix Improper Verification of Cryptographic Signature? Upgrade `io.netty:netty-handler` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Alpha1,4.2.15.Final)
C Incorrect Comparison io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server. Affected versions of this package are vulnerable to Incorrect Comparison in the `IpSubnetFilterRule.compareTo()` function. An attacker can gain unauthorized access by bypassing IPv6 subnet restrictions through incorrect masking of IP addresses. How to fix Incorrect Comparison? Upgrade `io.netty:netty-handler` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
H Allocation of Resources Without Limits or Throttling io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `SslClientHelloHandler.decode()` function. An attacker can cause excessive memory allocation by sending a specially crafted TLS handshake with a large handshake length value, leading to resource exhaustion and potential denial of service. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-handler` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Vulnerability

Vulnerable Version

Improper Verification of Cryptographic Signature

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in engineGetTrustManagers() and related methods. An attacker can intercept network traffic by providing a malicious X509TrustManager, which bypasses hostname verification during TLS connections.

How to fix Improper Verification of Cryptographic Signature?

Upgrade io.netty:netty-handler to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Alpha1,4.2.15.Final)

Incorrect Comparison

Affected versions of this package are vulnerable to Incorrect Comparison in the IpSubnetFilterRule.compareTo() function. An attacker can gain unauthorized access by bypassing IPv6 subnet restrictions through incorrect masking of IP addresses.

How to fix Incorrect Comparison?

Upgrade io.netty:netty-handler to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SslClientHelloHandler.decode() function. An attacker can cause excessive memory allocation by sending a specially crafted TLS handshake with a large handshake length value, leading to resource exhaustion and potential denial of service.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-handler to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

io.netty:netty-handler@4.2.14.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically