PT-2024-2588 · Netty+6 · Netty+6
Vietj
·
Published
2024-03-25
·
Updated
2026-05-18
·
CVE-2024-29025
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.1.108.Final
Description
The issue is related to the
HttpPostRequestDecoder in Netty, which can be tricked to accumulate data without limits. This can be achieved by sending a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list, or by cumulating bytes in the undecodedChunk buffer until a field can be decoded. The vulnerability can be exploited to cause a denial of service.Recommendations
For Netty versions prior to 4.1.108.Final, update to version 4.1.108.Final or later to resolve the issue. As a temporary workaround, consider restricting the number of fields that can be accumulated in the
bodyListHttpData list or limiting the size of the undecodedChunk buffer to prevent excessive data accumulation.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Netty
Red Os
Suse
Ubuntu