REDHAT-BUG-2536887: High severity Netty netty-codec-http vulnerability
Netty is a network application framework for development of protocol servers and clients.
SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. When a remote peer opens a SPDY connection and sends millions of SYNSTREAM frames with FLAGFIN=0, the server allocates unbounded heap and direct memory, eventually triggering JVM OutOfMemoryError and crashing the service.
This issue is tracked by GitHub Security Advisory GHSA-rmcw-9fcq-wjq7. No CVE ID has been assigned yet.
Affected package: io.netty:netty-codec-http - <= 4.1.137.Final, fixed in 4.1.138.Final - >= 4.2.0.Final, <= 4.2.17.Final, fixed in 4.2.18.Final
Upstream advisory: https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7 Releases: https://github.com/netty/netty/releases/tag/netty-4.1.138.Final https://github.com/netty/netty/releases/tag/netty-4.2.18.Final
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.18.FinalPatch GHSA-rmcw-9fcq-wjq7 - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.FinalPatch GHSA-rmcw-9fcq-wjq7
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this denial-of-service issue?
Servers using Netty's SPDY support through io.netty:netty-codec-http are exposed when they accept remote SPDY connections. A remote peer can consume heap and direct memory by opening a connection and creating very large numbers of unfinished streams.
Does exploiting this require authentication or prior access?
The described attack requires a remote peer that can open a SPDY connection to the server and send SYN_STREAM frames with FLAG_FIN=0. No authentication or prior local access requirement is stated.
Are default settings affected?
Yes. The localConcurrentStreams limit defaults to Integer.MAX_VALUE, and the affected handler provides no API to reduce that limit, allowing an unlimited number of remote-initiated streams.
Which package versions should be upgraded?
For the 4.1 line, versions through 4.1.137.Final are affected and 4.1.138.Final fixes the issue. For the 4.2 line, versions from 4.2.0.Final through 4.2.17.Final are affected and 4.2.18.Final fixes it.