Critical Vulnerability in Netty: Unbounded Accumulation of Data in HttpPostRequestDecoder
Summary
DEBIAN-CVE-2024-29025: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Affects netty versions < 1:4.1.48-10. Fixed in 1:4.1.48-10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is an asynchronous event-driven network application framework designed for rapid development of maintainable high-performance protocol servers and clients. It provides a robust architecture for handling network communications, making it a popular choice for developers building scalable applications. However, it is susceptible to vulnerabilities that can lead to resource exhaustion and denial of service if not properly managed.
Vulnerability Detail
The vulnerability arises from the HttpPostRequestDecoder, which can be manipulated to accumulate an unbounded amount of data. An attacker can exploit this by sending a chunked POST request with numerous small fields, causing the decoder to store excessive data in the bodyListHttpData list. This can lead to resource exhaustion, potentially resulting in denial of service as the system struggles to handle the accumulated data. The vulnerability is fixed in version 4.1.108.Final.
How To Fix
Minimum fixed version
1:4.1.48-10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nettyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of the incoming requests by configuring the server to reject excessively large POST requests. This can be done by setting appropriate limits in your server configuration files.
Conclusion
The vulnerability in Netty's HttpPostRequestDecoder poses a significant risk by allowing unbounded data accumulation, which can lead to denial of service. It is crucial for users to update to the patched version and consider implementing temporary workarounds to safeguard their applications.
See every vulnerability recorded for netty →
FAQ
The vulnerability allows an attacker to send an unbounded number of fields in a POST request, leading to potential resource exhaustion.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, Vulert can alert you in real-time. You can also check your application using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to denial of service as the application may become overwhelmed with excessive data accumulation.
Yes, the vulnerability is fixed in version 4.1.108.Final of Netty. It is recommended to update to this version.
Implement request size limits in your server configuration to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for netty.
