CVE-2024-29025 — Allocation of Resources Without Limits or Throttling in Netty
Severity
5.3MEDIUMNVD
OSV5.5
EPSS
0.3%
top 44.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Latest updateApr 15
Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in th…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4
Affected Packages5 packages
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
4OSV▶
CVE-2024-29025: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients↗2024-03-25