PT-2024-7028 · Unknown+2 · Resteasy-Netty4+2

Txema-Martinez-Scopely · Published 2024-10-07 · Updated 2025-07-10 · CVE-2024-9622

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions resteasy-netty4 library (affected versions not specified)

Description A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts. This issue may impact systems using load balancers and expose them to risk. The vulnerability can be exploited by a remote attacker to send hidden HTTP requests, also known as HTTP Request Smuggling attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2024-08282

CVE-2024-9622

GHSA-5WPR-CJ9P-959R

USN-7351-1

USN-7630-1

Affected Products

Linuxmint

Ubuntu

Resteasy-Netty4

References · 32

• https://ubuntu.com/security/CVE-2020-25633 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0482 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6346 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7351-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6347 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wpr-cj9p-959r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9622 · Security Note
• https://ubuntu.com/security/notices/USN-7630-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-9622 · Security Note
• https://ubuntu.com/security/CVE-2016-7050 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7630-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08282 · Security Note
• https://ubuntu.com/security/CVE-2020-1695 · Vendor Advisory