REDHAT-BUG-2507482: High severity Netty netty-codec-http vulnerability
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final, the HTTP decoder in netty-codec-http fails to properly limit decompression of HTTP body content encoded with gzip or other compression algorithms. An attacker can send HTTP requests with highly compressed payloads that decompress to enormous sizes, causing memory exhaustion and denial of service. This issue is fixed in versions 4.1.136.Final and later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netty (netty-codec-http HTTP decoder)to a version that resolves this vulnerability.Fixed in 4.1.136.Final
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2507482?
The severity of REDHAT-BUG-2507482 is high with a score of 7.
What is the risk associated with REDHAT-BUG-2507482?
The risk associated with REDHAT-BUG-2507482 is rated at 33.
How do I fix REDHAT-BUG-2507482?
To address REDHAT-BUG-2507482, upgrade to Netty version 4.1.136.Final or later.
What issue does REDHAT-BUG-2507482 describe?
REDHAT-BUG-2507482 describes a vulnerability in the HTTP decoder of netty-codec-http that fails to properly limit decompression of HTTP body content.
What impact does REDHAT-BUG-2507482 potentially have on applications?
REDHAT-BUG-2507482 potentially allows attackers to exploit decompression vulnerabilities, leading to denial of service or application crashes.