Aest3Ra

**Name of the Vulnerable Software and Affected Versions** Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final **Description** Request-line validation can be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created and its URI is subsequently modified using the `setUri()` function. While constructors reject CRLF (Carriage Return Line Feed) and whitespace characters to prevent start-line corruption, `setUri()` does not perform this validation. Consequently, `HttpRequestEncoder` and `RtspEncoder` write the URI into the request line verbatim. If attacker-controlled input is passed to `setUri()`, it enables CRLF injection and the insertion of additional HTTP or RTSP requests. This can lead to HTTP request smuggling, desynchronization on the HTTP side, and request injection on the RTSP side. **Recommendations** Update to version 4.1.133.Final or later. Update to version 4.2.13.Final or later. As a temporary workaround, avoid using the `setUri()` function with attacker-controlled input.

**Name of the Vulnerable Software and Affected Versions** NiceGUI versions prior to 3.9.0 **Description** NiceGUI’s `app.add media file()` and `app.add media files()` functions are susceptible to a flaw where a user-controlled query parameter, passed to the range-response implementation without validation, can bypass chunked streaming. This allows an attacker to force the server to load entire files into memory. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. The vulnerable functions are used for serving media content. The parameter is passed to the `range-response` implementation. **Recommendations** Upgrade to NiceGUI version 3.9.0 or later. As a workaround, restrict access to media endpoints. As a workaround, strip unexpected query parameters at a reverse proxy layer.