CVE-2024-29025: Netty's HttpPostRequestDecoder can OOM
The HttpPostRequestDecoder can be tricked to accumulate data. I have spotted currently two attack vectors
References
- gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3
- github.com/advisories/GHSA-5jpm-x58v-624v
- github.com/netty/netty
- github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c
- github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v
- github.com/vietj/netty/tree/post-request-decoder
- nvd.nist.gov/vuln/detail/CVE-2024-29025
Code Behaviors & Features
Detect and mitigate CVE-2024-29025 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →