GHSA-7vpq-g998-qpv7Medium

Netty denial of service vulnerability

Published
May 13, 2022
Last Modified
April 16, 2024

🔗 CVE IDs covered (1)

CVE-2014-0193 →

📋 Description

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

🎯 Affected products6

  • maven/io.netty:netty:>= 3.6.0.Beta1, < 3.6.9.Final
  • maven/io.netty:netty:>= 3.7.0.Final, < 3.7.1.Final
  • maven/io.netty:netty:>= 3.8.0.Final, < 3.8.2.Final
  • maven/io.netty:netty:>= 3.9.0.Final, < 3.9.1.Final
  • maven/io.netty:netty:>= 4.0.0.Alpha1, < 4.0.19.Final
  • maven/io.netty:netty-all:>= 4.0.0.Alpha1, < 4.0.19.Final

🔗 References (18)