CVE-2015-2156
Information Exposure in Netty
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
CVE-2015-2156- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
CVE-2015-2156- Updated
- 2026-11-02
EUVDEUVD-2020-0524 No score
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
EUVD-2020-0524- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xfv3-rrfm-f2rv
Information Exposure in Netty
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
GHSA-xfv3-rrfm-f2rv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
CVE-2015-2156- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2156
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
DEBIAN-CVE-2015-2156- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-xfv3-rrfm-f2rv
Information Exposure in Netty
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
GHSA-xfv3-rrfm-f2rv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2156
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Record
UBUNTU-CVE-2015-2156- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.netty:netty-parentMaven |
4.0.0 up to 4.0.28.Final | 4.0.28.Final |
org.jboss.netty:nettyMaven |
before 3.9.8.Final | 3.9.8.Final |
org.jboss.netty:nettyMaven |
3.10.0 up to 3.10.3.Final | 3.10.3.Final |
io.netty:nettyMaven |
3.10.0 up to 3.10.3.Final | 3.10.3.Final |
io.netty:nettyMaven |
before 3.9.8.Final | 3.9.8.Final |
nettyDebian:12 |
before 1:4.0.31-1 | 1:4.0.31-1 |
nettyDebian:13 |
before 1:4.0.31-1 | 1:4.0.31-1 |
nettyDebian:14 |
before 1:4.0.31-1 | 1:4.0.31-1 |
io.netty:netty-parentMaven |
4.0.0 up to 4.0.28.Final, plus listed versions 4.0.0.Final4.0.1.Final4.0.10.Final4.0.11.Final4.0.12.Final Show 24 moreShow less4.0.13.Final4.0.14.Beta14.0.14.Final4.0.15.Final4.0.16.Final4.0.17.Final4.0.18.Final4.0.19.Final4.0.2.Final4.0.20.Final4.0.21.Final4.0.22.Final4.0.23.Final4.0.24.Final4.0.25.Final4.0.26.Final4.0.27.Final4.0.3.Final4.0.4.Final4.0.5.Final4.0.6.Final4.0.7.Final4.0.8.Final4.0.9.Final |
4.0.28.Final |
org.jboss.netty:nettyMaven |
before 3.9.8.Final, plus listed versions 3.0.0.CR13.0.0.CR23.0.0.CR33.0.0.CR43.0.0.CR5 Show 34 moreShow less3.0.0.GA3.0.1.GA3.0.2.GA3.1.0.ALPHA13.1.0.ALPHA23.1.0.ALPHA33.1.0.ALPHA43.1.0.BETA13.1.0.BETA23.1.0.BETA33.1.0.CR13.1.0.GA3.1.1.GA3.1.2.GA3.1.3.GA3.1.4.GA3.1.5.GA3.2.0.ALPHA13.2.0.ALPHA23.2.0.ALPHA33.2.0.ALPHA43.2.0.BETA13.2.0.CR13.2.0.Final3.2.1.Final3.2.10.Final3.2.2.Final3.2.3.Final3.2.4.Final3.2.5.Final3.2.6.Final3.2.7.Final3.2.8.Final3.2.9.Final |
3.9.8.Final |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.netty:nettyMaven |
3.10.0 up to 3.10.3.Final, plus listed versions 3.10.0.Final3.10.1.Final3.10.2.Final |
3.10.3.Final |
io.netty:nettyMaven |
before 3.9.8.Final, plus listed versions 3.3.0.Final3.3.1.Final3.4.0.Alpha13.4.0.Alpha23.4.0.Beta1 Show 45 moreShow less3.4.0.Final3.4.1.Final3.4.2.Final3.4.3.Final3.4.4.Final3.4.5.Final3.4.6.Final3.5.0.Beta13.5.0.Final3.5.1.Final3.5.10.Final3.5.11.Final3.5.12.Final3.5.13.Final3.5.2.Final3.5.3.Final3.5.4.Final3.5.5.Final3.5.6.Final3.5.7.Final3.5.8.Final3.5.9.Final3.6.0.Beta13.6.0.Final3.6.1.Final3.6.10.Final3.6.2.Final3.6.3.Final3.6.4.Final3.6.5.Final3.6.6.Final3.6.7.Final3.6.8.Final3.6.9.Final3.7.0.Final3.7.1.Final3.8.0.Final3.8.1.Final3.8.2.Final3.8.3.Final3.9.0.Final3.9.1.1.Final3.9.1.Final3.9.2.Final3.9.3.Final |
3.9.8.Final |
nettyUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:3.2.6.Final-21:3.2.6.Final-2+deb8u2build0.14.04.1~esm11:3.2.6.Final-2+deb8u2ubuntu0.1~esm1 |
None known |
netty-3.9Ubuntu:16.04:LTS |
All versions, plus listed versions 3.9.0.Final-13.9.0.Final-1ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2156 is a high vulnerability (CVSS 7.5) in Lightbend Play Framework, published October 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.22%, the 92nd percentile. Fixed in io.netty:netty-parent 4.0.28.Final.
References
netty.io/news/2015/05/08/3-9-8-Final-and-3.html
playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html
bugzilla.redhat.com/show_bug.cgi?id=1222923
github.com/netty/netty/pull/3754
Show 22 moreShow less
securityfocus.com/bid/74704
openwall.com/lists/oss-security/2015/05/17/1
lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2015-2156
snyk.io/vuln/SNYK-JAVA-IONETTY-73571
security-tracker.debian.org/tracker/CVE-2015-2156
ubuntu.com/security/CVE-2015-2156
engineering.linkedin.com/security/look-netty%E2%80%99s-recent-security-update-cve%C2%AD-2015%C2%AD-2156
cve.org/CVERecord?id=CVE-2015-2156
Left out here: 4 versions. The JSON record has them.