CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

Summary

The HttpPostRequestDecoder can be tricked to accumulate data. I have spotted currently two attack vectors

Details

1. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list.
2. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits

PoC

Here is a Netty branch that provides a fix + tests : https://github.com/vietj/netty/tree/post-request-decoder

Here is a reproducer with Vert.x (which uses this decoder) https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3

Impact

Any Netty based HTTP server that uses the HttpPostRequestDecoder to decode a form.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Security Fix(es):

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.(CVE-2024-29025)

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc < - %description help Man pages and other related documents for .

Security Fix(es):

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.(CVE-2024-29025)

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.

CVE-2024-29025: Netty HttpPostRequestDecoder can OOM

CVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

CVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

CVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

CVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing

CVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

CVE-2026-42584: Netty: HttpClientCodec response desynchronization

CVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

CVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

CVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

CVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map

CVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

CVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

CVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

CVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

CVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

This patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

TuxCare rebuilt 43 io.netty packages to address 12 CVEs. Fixed in 4.1.63.Final-tuxcare.2.

TuxCare rebuilt 40 io.netty packages to address 16 CVEs. Fixed in 4.1.52.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 15 CVEs. Fixed in 4.1.60.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 12 CVEs. Fixed in 4.1.93.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 7 CVEs. Fixed in 4.1.92.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.82.Final-tuxcare.7.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt 4 io.netty packages to address 4 CVEs. Fixed in 4.1.94.Final-tuxcare.2.

TuxCare rebuilt 11 io.netty packages to address 20 CVEs. Fixed in 4.1.73.Final-tuxcare.5.

TuxCare rebuilt 11 io.netty packages to address 18 CVEs. Fixed in 4.1.87.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.99.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 19 CVEs. Fixed in 4.1.80.Final-tuxcare.1.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.42.Final-tuxcare.2.

TuxCare rebuilt 7 io.netty packages to address 15 CVEs. Fixed in 4.1.101.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.96.Final-tuxcare.1.

TuxCare rebuilt 9 io.netty packages to address 13 CVEs. Fixed in 4.1.81.Final-tuxcare.1.

TuxCare rebuilt 15 io.netty packages to address 27 CVEs. Fixed in 4.1.72.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 26 CVEs. Fixed in 4.1.53.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 11 CVEs. Fixed in 4.1.39.Final-tuxcare.1.

TuxCare rebuilt 11 io.netty packages to address 21 CVEs. Fixed in 4.1.51.Final-tuxcare.1.

TuxCare rebuilt 4 io.netty packages to address 6 CVEs. Fixed in 4.1.24.Final-tuxcare.1.

TuxCare rebuilt 4 io.netty packages to address 6 CVEs. Fixed in 4.1.29.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 10 CVEs. Fixed in 4.1.21.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.31.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 11 CVEs. Fixed in 4.1.43.Final-tuxcare.3.

TuxCare rebuilt 5 io.netty packages to address 6 CVEs. Fixed in 4.1.48.Final-tuxcare.5.

TuxCare rebuilt 6 io.netty packages to address 8 CVEs. Fixed in 4.1.38.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.23.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.74.Final-tuxcare.1.

TuxCare rebuilt 10 io.netty packages to address 17 CVEs. Fixed in 4.1.49.Final-tuxcare.6.

TuxCare rebuilt 4 io.netty packages to address 8 CVEs. Fixed in 4.1.68.Final-tuxcare.2.

TuxCare rebuilt 6 io.netty packages to address 10 CVEs. Fixed in 4.1.100.Final-tuxcare.2.

TuxCare rebuilt 14 io.netty packages to address 32 CVEs. Fixed in 4.1.64.Final-tuxcare.1.