Impact of HTTP Smuggling on Load Balancers and Systems

CVE-2024-9622

Summary

The Resteasy-Netty4 library contains a vulnerability linked to improper handling of HTTP requests that employs smuggling techniques. Specifically, this issue arises when an HTTP smuggling request containing an ASCII control character triggers the Netty HttpObjectDecoder to enter a BAD_MESSAGE state. As a consequence, any subsequent legitimate requests on the same connection are disregarded, resulting in client timeouts. This behavior can significantly impact systems that utilize load balancers, thereby increasing their exposure to potential risks.

References