Improper Input Validation Affecting io.netty.incubator:netty-incubator-codec-bhttp package, versions [,0.0.13.Final)
Threat Intelligence
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-IONETTYINCUBATOR-7545165
- published 19 Jul 2024
- disclosed 18 Jul 2024
- credit shombo
Introduced: 18 Jul 2024
CVE-2024-40642 Open this link in a new tabHow to fix?
Upgrade io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.13.Final or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation via the readRequestHead method. An attacker can manipulate HTTP requests and perform various injection attacks by exploiting the lack of proper input validation and the ability to pass arbitrary values into HTTP methods.