CVE-2022-41915: Netty Codec HTTP - HTTP Response Splitting Vulnerability
Summary
CVE-2022-41915: Netty vulnerable to HTTP Response splitting from assigning header value iterator. Affects io.netty:netty-codec-http versions >= 4.1.83.Final, < 4.1.86.Final. Fixed in 4.1.86.Final. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2022-41915 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular open-source networking framework written in Java. It provides an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. The Netty Codec HTTP module is responsible for handling HTTP requests and responses. It is widely used in various applications and frameworks that require HTTP communication.
Vulnerability Detail
The Netty Codec HTTP module is vulnerable to HTTP Response Splitting attacks. This vulnerability arises when the DefaultHttpHeaders.set method is called with an iterator of values instead of a single value. The module fails to perform proper validation of header values in the iterator, allowing malicious header values to be injected. An attacker can exploit this vulnerability to manipulate HTTP responses, potentially leading to various security issues such as cache poisoning, cross-site scripting (XSS), and session hijacking.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.86.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Netty is not immediately feasible, a temporary workaround can be implemented. Instead of using the DefaultHttpHeaders.set(CharSequence, Iterator<?>) method, you can remove the existing header using the remove(CharSequence) method and then add each value from the iterator using the add(CharSequence) method in a loop. This ensures that each header value is properly validated and prevents HTTP Response Splitting attacks.
Conclusion
The Netty Codec HTTP module is vulnerable to HTTP Response Splitting attacks. It is crucial to promptly address this vulnerability by upgrading to the latest version of Netty or implementing the provided workaround. Failure to do so may expose your application to various security risks. If you need further assistance or support in remediating this vulnerability, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-codec-http →
FAQ
Netty is an open-source networking framework written in Java. It provides an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients.
The Netty Codec HTTP module is responsible for handling HTTP requests and responses. It is widely used in various applications and frameworks that require HTTP communication.
HTTP Response Splitting is a web application vulnerability that allows an attacker to manipulate HTTP responses by injecting malicious header values. This can lead to security issues such as cache poisoning, cross-site scripting (XSS), and session hijacking.
This vulnerability can allow an attacker to manipulate HTTP responses, potentially leading to cache poisoning, cross-site scripting (XSS), and session hijacking. It can also undermine the integrity and security of the affected application or system.
To fix this vulnerability, it is recommended to upgrade to Netty version 4.1.86.Final or later. This version includes the necessary validation to prevent HTTP Response Splitting attacks. Update the Netty dependency in your project's Maven configuration or build file to the latest version to ensure the vulnerability is patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec-http.
