Executive brief
HTTP request smuggling in netty
Affected products
- Maven io.netty:netty-codec-http
- Maven io.netty:netty
- Maven org.jboss.netty:netty
Junglewise Threat Intelligence
CVE-2021-43797: HTTP request smuggling in netty
CVE-2021-43797 · Severity: low · CVSS 3.1 · Published 2021-12-09
Technologies: io.netty:netty-codec-http (Maven), io.netty:netty (Maven), org.jboss.netty:netty (Maven). Vendors: Maven.
Related threats
- Netty's HttpPostRequestDecoder can OOM
- Netty vulnerable to HTTP Response splitting from assigning header value iterator
- Local Information Disclosure Vulnerability in io.netty:netty-codec-http
- SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
- Bzip2Decoder doesn't allow setting size restrictions for decompressed data