Netty vulnerabilities

A vulnerability in Netty prior to versions 4.1.132.Final and 4.2.10.Final causes incorrect parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request, leading to request smuggling when used without proper URI sanitization. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Netty versions prior to 4.1.128.Final and 4.2.7.Final contain an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. Parameters are directly concatenated into the SMTP command string without sanitization, allowing attackers to inject arbitrary SMTP commands. Because injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM checks, allowing remote attackers to forge arbitrary emails from the trusted server. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final.

A vulnerability in Netty's decompression decoders, including BrotliDecoder, allows specially crafted input to allocate a large number of reachable byte buffers, potentially leading to denial of service. Decompression lacks a limit on pull calls, processing data in 64K chunks, and buffers remain reachable until OOM occurs.

Netty versions 4.1.124.Final and 4.2.0.Alpha3 through 4.2.4.Final incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently, attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks.

The vulnerability in `SniHandler` in the Netty framework allows for the allocation of up to 16MB of heap for each channel during the TLS handshake. The lack of proper checks enables the crafting of a packet that can exploit this allocation, potentially leading to resource exhaustion.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

Netty is an open-source, asynchronous event-driven network application framework. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.