Description · from the CVE record
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected
ProductAffectedFixed inSource
netty>= 4.2.0.Alpha1, < 4.2.13.Final–CNA
netty< 4.1.133.Final–CNA
Cryostat 4 on RHEL 9see advisory4.2.0-10redhat-SADP
Cryostat 4 on RHEL 9see advisory4.2.0-10redhat-SADP
Cryostat 4 on RHEL 9see advisory4.2.0-10redhat-SADP
Red Hat AMQ Broker 7.13.6see advisorycodec-httpredhat-SADP
Red Hat AMQ Broker 7.14.1see advisorycodec-httpredhat-SADP
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16see advisorycodec-httpredhat-SADP
Red Hat build of Quarkus 3.27.4see advisorycodec-httpredhat-SADP
Red Hat build of Quarkus 3.33.2see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.16.0-22.redhat_00057.1.el7eapredhat-SADP
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7see advisory0:2.3.14-11.SP11_redhat_00001.1.el7eapredhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
GitHub_M (CNA)5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial
by Kastro