io.netty.incubator:netty-incubator-codec-bhttp 0.0.21.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty.incubator:netty-incubator-codec-bhttp package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced limits on variable length fields in the `BinaryHttpParser`. An attacker can exhaust system memory by sending specially crafted requests with excessively large or numerous variable length fields, causing the application to buffer unbounded data. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty.incubator:netty-incubator-codec-bhttp` to version 0.0.23.Final or higher.	[,0.0.23.Final)
H Infinite loop Affected versions of this package are vulnerable to Infinite loop in the `readFieldSection` process. An attacker can cause the parsing thread to enter an infinite loop by sending a specially crafted Binary HTTP input where a known-length field section ends exactly after a complete field line, resulting in resource exhaustion and denial of service. How to fix Infinite loop? Upgrade `io.netty.incubator:netty-incubator-codec-bhttp` to version 0.0.23.Final or higher.	[,0.0.23.Final)
M Incorrect Conversion between Numeric Types Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the `BinaryHttpParser` process. An attacker can cause the decoder to crash and disrupt service availability by sending a specially crafted Binary HTTP payload with large variable-length integers that trigger unchecked integer overflow and out-of-bounds buffer access. How to fix Incorrect Conversion between Numeric Types? Upgrade `io.netty.incubator:netty-incubator-codec-bhttp` to version 0.0.23.Final or higher.	[,0.0.23.Final)
H Infinite loop Affected versions of this package are vulnerable to Infinite loop through the `readFieldSection` process. An attacker can cause the application to enter an infinite loop and exhaust CPU resources by sending a specially crafted Binary HTTP message with a manipulated field-section length, resulting in permanent occupation of event-loop threads and denial of service. How to fix Infinite loop? Upgrade `io.netty.incubator:netty-incubator-codec-bhttp` to version 0.0.23.Final or higher.	[,0.0.23.Final)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced limits on variable length fields in the BinaryHttpParser. An attacker can exhaust system memory by sending specially crafted requests with excessively large or numerous variable length fields, causing the application to buffer unbounded data.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.23.Final or higher.

[,0.0.23.Final)

Infinite loop

Affected versions of this package are vulnerable to Infinite loop in the readFieldSection process. An attacker can cause the parsing thread to enter an infinite loop by sending a specially crafted Binary HTTP input where a known-length field section ends exactly after a complete field line, resulting in resource exhaustion and denial of service.

How to fix Infinite loop?

Upgrade io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.23.Final or higher.

[,0.0.23.Final)

Incorrect Conversion between Numeric Types

Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the BinaryHttpParser process. An attacker can cause the decoder to crash and disrupt service availability by sending a specially crafted Binary HTTP payload with large variable-length integers that trigger unchecked integer overflow and out-of-bounds buffer access.

How to fix Incorrect Conversion between Numeric Types?

Upgrade io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.23.Final or higher.

[,0.0.23.Final)

Infinite loop

Affected versions of this package are vulnerable to Infinite loop through the readFieldSection process. An attacker can cause the application to enter an infinite loop and exhaust CPU resources by sending a specially crafted Binary HTTP message with a manipulated field-section length, resulting in permanent occupation of event-loop threads and denial of service.

How to fix Infinite loop?

Upgrade io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.23.Final or higher.

[,0.0.23.Final)

io.netty.incubator:netty-incubator-codec-bhttp@0.0.21.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically