Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
netty netty vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2019-17513
An issue exists in Ratpack prior to 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
Ratpack Project Ratpack
5
CVSSv2
CVE-2019-11284
Pivotal Reactor Netty, versions before 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Pivotal Reactor Netty
5
CVSSv2
CVE-2019-16869
Netty prior to 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Netty Netty
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Canonical Ubuntu Linux 18.04
Redhat Jboss Enterprise Application Platform 7.2
Redhat Jboss Enterprise Application Platform 7.3
Redhat Jboss Enterprise Application Platform 7.4
5
CVSSv2
CVE-2017-13763
ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
Onosproject Onos 1.10.0
Onosproject Onos 1.9.0
Onosproject Onos 1.8.0
5
CVSSv2
CVE-2014-3488
The SslHandler in Netty prior to 3.9.2 allows remote malicious users to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Netty Netty 3.8.1
Netty Netty 3.8.0
Netty Netty 3.7.0
Netty Netty 3.6.8
Netty Netty
Netty Netty 3.9.0
Netty Netty 3.6.7
Netty Netty 3.6.5
Netty Netty 3.6.3
Netty Netty 3.6.2
Netty Netty 3.6.1
Netty Netty 3.6.0
Netty Netty 3.9.1
Netty Netty 3.6.6
Netty Netty 3.6.4
1 Github repository
4.9
CVSSv2
CVE-2020-5404
The HttpClient from Reactor Netty, versions 0.9.x before 0.9.5, and versions 0.8.x before 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to fo...
Pivotal Reactor Netty
4.3
CVSSv2
CVE-2022-0552
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origi...
Redhat Origin-aggregated-logging 3.11
4.3
CVSSv2
CVE-2021-43797
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It s...
Netty Netty
Quarkus Quarkus
Netapp Snapcenter -
Netapp Oncommand Workflow Automation -
Oracle Banking Platform 2.6.2
Oracle Peoplesoft Enterprise Peopletools 8.58
Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Peoplesoft Enterprise Peopletools 8.59
Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.7.0
Oracle Banking Party Management 2.7.0
Oracle Communications Design Studio 7.4.2
Oracle Communications Cloud Native Core Policy 1.15.0
Oracle Communications Cloud Native Core Unified Data Repository 1.15.0
Oracle Communications Cloud Native Core Network Slice Selection Function 1.8.0
Oracle Communications Cloud Native Core Binding Support Function 1.11.0
Oracle Helidon 2.4.0
Oracle Helidon 1.4.10
Oracle Communications Instant Messaging Server 8.1
Oracle Banking Deposits And Lines Of Credit Servicing 2.7
Debian Debian Linux 10.0
Debian Debian Linux 11.0
4.3
CVSSv2
CVE-2021-21409
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request ...
Netty Netty
Debian Debian Linux 10.0
Netapp Oncommand Workflow Automation -
Netapp Oncommand Api Services -
Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Banking Trade Finance Process Management 14.3.0
Oracle Banking Credit Facilities Process Management 14.3.0
Oracle Banking Corporate Lending Process Management 14.3.0
Oracle Primavera Gateway
Oracle Banking Trade Finance Process Management 14.5.0
Oracle Banking Credit Facilities Process Management 14.2.0
Oracle Banking Credit Facilities Process Management 14.5.0
Oracle Banking Corporate Lending Process Management 14.2.0
Oracle Banking Corporate Lending Process Management 14.5.0
Oracle Banking Trade Finance Process Management 14.2.0
Oracle Communications Messaging Server 8.1
Oracle Communications Brm - Elastic Charging Engine 12.0.0.3
Oracle Communications Design Studio 7.4.2.0.0
Oracle Communications Cloud Native Core Console 1.7.0
Oracle Nosql Database
Oracle Communications Cloud Native Core Policy 1.14.0
4.3
CVSSv2
CVE-2019-10797
Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.
Wso2 Transport-http
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32886
insecure direct object reference
CVE-2024-34342
file inclusion
CVE-2024-34562
CVE-2024-34347
CVE-2024-26026
CVE-2024-4647
unprivileged
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
NEXT »