Към съдържанието
Търсене

CVE-2026-42581: netty, друго

7.2

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Засегнати продукти

  • netty netty: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final
  • Red Hat: още 34 продукта, добавени от Red Hat

    Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat build of Quarkus 3.27.4, Red Hat build of Quarkus 3.33.2, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, Red Hat JBoss Enterprise Application Platform 8.1.7.GA, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9, Streams for Apache Kafka 3.2.1, Red Hat OpenShift AI 2.25, Red Hat OpenShift Dev Spaces 3.28, Red Hat OpenShift Dev Spaces 3.29, OpenShift Serverless, Red Hat AMQ Clients, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat Data Grid 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Single Sign-On 7, streams for Apache Kafka 2

Вид слабост

История

  • 13 май 2026 Публикувано

Други уязвимости в netty netty

Първоизточници

CVE-2026-42581: netty, друго | freedomonline.bg