Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. io.netty.incubator/netty-incubator-codec-bhttp
  4. ›
  5. CVE-2024-40642

CVE-2024-40642: Absent Input Validation in BinaryHttpParser

July 18, 2024

BinaryHttpParser does not properly validate input values thus giving attackers almost complete control over the HTTP requests constructed from the parsed output. Attackers can abuse several issues individually to perform various injection attacks including HTTP request smuggling, desync attacks, HTTP header injections, request queue poisoning, caching attacks and Server Side Request Forgery (SSRF). Attacker could also combine several issues to create well-formed messages for other text-based protocols which may result in attacks beyond the HTTP protocol.

References

  • github.com/advisories/GHSA-q8f2-hxq5-cp4h
  • github.com/netty/netty-incubator-codec-ohttp
  • github.com/netty/netty-incubator-codec-ohttp/commit/b687a0cf6ea1030232ea204d73bce82f2698e571
  • github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-q8f2-hxq5-cp4h
  • nvd.nist.gov/vuln/detail/CVE-2024-40642

Code Behaviors & Features

Detect and mitigate CVE-2024-40642 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.0.13.Final

Fixed versions

  • 0.0.13.Final

Solution

Upgrade to version 0.0.13.Final or above.

Impact 8.1 HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation

Source file

maven/io.netty.incubator/netty-incubator-codec-bhttp/CVE-2024-40642.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:39 +0000.