PT-2022-6921 · Netty+5 · Netty+5
Normanmaurer
·
Published
2022-12-12
·
Updated
2026-05-18
·
CVE-2022-41881
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.1.86.Final
Description
The issue is related to an infinite recursion when parsing a malformed crafted message, which can lead to a StackOverflowError. This can be exploited by a remote attacker to cause a denial of service. The recursion occurs when parsing a TLV with type = PP2 TYPE SSL, where the value can be another TLV with the same type, and so on. The only limitation to the recursion is the TLV length, which cannot exceed 0xffff due to its encoding in an unsigned short type. Providing a TLV with a sufficiently large nesting level can cause a StackOverflowError.
Recommendations
For versions prior to 4.1.86.Final, upgrade to version 4.1.86.Final to resolve the issue. As a temporary workaround, consider using a custom HaProxyMessageDecoder.
Exploit
Fix
DoS
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Netty
Red Os
Suse
Ubuntu