Netty BinaryHttpParser Vulnerability

CVE-2024-40642

Summary

The vulnerability in Netty's incubator codec.bhttp arises from the improper validation of input values in the BinaryHttpParser class. Attackers could leverage this lack of validation to gain substantial control over constructed HTTP requests. The flaws may lead to multiple injection attacks including HTTP request smuggling, desynchronization attacks, and HTTP header injections, among others. Furthermore, malicious actors may combine these vulnerabilities to formulate well-crafted messages for various text-based protocols, extending the potential impact beyond simple HTTP interactions. The vulnerable method, readRequestHead, inadequately processes input, ultimately allowing for serious exploitation without sufficient safeguards. To mitigate these vulnerabilities, users are strongly urged to upgrade to version 0.0.13.Final, as there are no known workarounds.

References