Read the docs
TI-2014-00187 Aliases CVE-2014-0193GHSA-7vpq-g998-qpv7

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before…

Priority LOW 30CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 12 fixed, 7 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

Why it matters now

EPSS 0.04326 91st percentileScored 2026-11-07
Fix Partial io.netty:netty (Maven): 3.6.9.Final, 3.7.1.Final, 3.8.2.Final +2io.netty:netty-all (Maven): 4.0.19.FinalRed Hat: 12 advisoriesRed Hat: 12 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—io.netty:netty (Maven)3.6.0.Beta1 to before 3.6.9.Final3.6.9.FinalPatch availableGHSA-7vpq-g998-qpv7
—io.netty:netty (Maven)3.7.0.Final to before 3.7.1.Final3.7.1.FinalPatch availableGHSA-7vpq-g998-qpv7
—io.netty:netty (Maven)3.8.0.Final to before 3.8.2.Final3.8.2.FinalPatch availableGHSA-7vpq-g998-qpv7
—io.netty:netty (Maven)3.9.0.Final to before 3.9.1.Final3.9.1.FinalPatch availableGHSA-7vpq-g998-qpv7
—io.netty:netty (Maven)4.0.0.Alpha1 to before 4.0.19.Final4.0.19.FinalPatch availableGHSA-7vpq-g998-qpv7
—io.netty:netty-all (Maven)4.0.0.Alpha1 to before 4.0.19.Final4.0.19.FinalPatch availableGHSA-7vpq-g998-qpv7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • io.netty:netty (Maven) Vendor— Affected 3.6.0.Beta1 to before 3.6.9.Final Fixed in 3.6.9.Final Patch available GHSA-7vpq-g998-qpv7
  • io.netty:netty (Maven) Vendor— Affected 3.7.0.Final to before 3.7.1.Final Fixed in 3.7.1.Final Patch available GHSA-7vpq-g998-qpv7
  • io.netty:netty (Maven) Vendor— Affected 3.8.0.Final to before 3.8.2.Final Fixed in 3.8.2.Final Patch available GHSA-7vpq-g998-qpv7
  • io.netty:netty (Maven) Vendor— Affected 3.9.0.Final to before 3.9.1.Final Fixed in 3.9.1.Final Patch available GHSA-7vpq-g998-qpv7
  • io.netty:netty (Maven) Vendor— Affected 4.0.0.Alpha1 to before 4.0.19.Final Fixed in 4.0.19.Final Patch available GHSA-7vpq-g998-qpv7
  • io.netty:netty-all (Maven) Vendor— Affected 4.0.0.Alpha1 to before 4.0.19.Final Fixed in 4.0.19.Final Patch available GHSA-7vpq-g998-qpv7

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:3.6.0:*:*:*:*:*:*:*3.6.0Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.1:*:*:*:*:*:*:*3.6.1Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.2:*:*:*:*:*:*:*3.6.2Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.3:*:*:*:*:*:*:*3.6.3Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.4:*:*:*:*:*:*:*3.6.4Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.5:*:*:*:*:*:*:*3.6.5Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.6:*:*:*:*:*:*:*3.6.6Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.7:*:*:*:*:*:*:*3.6.7Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.8:*:*:*:*:*:*:*3.6.8Vulnerablenetty
cpe:2.3:a:netty:netty:3.7.0:*:*:*:*:*:*:*3.7.0Vulnerablenetty
  • cpe:2.3:a:netty:netty:3.6.0:*:*:*:*:*:*:* Versions 3.6.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.2:*:*:*:*:*:*:* Versions 3.6.2 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.3:*:*:*:*:*:*:* Versions 3.6.3 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.4:*:*:*:*:*:*:* Versions 3.6.4 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.6:*:*:*:*:*:*:* Versions 3.6.6 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.7:*:*:*:*:*:*:* Versions 3.6.7 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.8:*:*:*:*:*:*:* Versions 3.6.8 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.7.0:*:*:*:*:*:*:* Versions 3.7.0 Vulnerable ·netty
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:3.8.0:*:*:*:*:*:*:*3.8.0Vulnerablenetty
cpe:2.3:a:netty:netty:3.8.1:*:*:*:*:*:*:*3.8.1Vulnerablenetty
cpe:2.3:a:netty:netty:3.9.0:*:*:*:*:*:*:*3.9.0Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.0:*:*:*:*:*:*:*4.0.0Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.1:*:*:*:*:*:*:*4.0.1Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.2:*:*:*:*:*:*:*4.0.2Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.3:*:*:*:*:*:*:*4.0.3Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.4:*:*:*:*:*:*:*4.0.4Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.5:*:*:*:*:*:*:*4.0.5Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.6:*:*:*:*:*:*:*4.0.6Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.7:*:*:*:*:*:*:*4.0.7Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.8:*:*:*:*:*:*:*4.0.8Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.9:*:*:*:*:*:*:*4.0.9Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.10:*:*:*:*:*:*:*4.0.10Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.11:*:*:*:*:*:*:*4.0.11Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.12:*:*:*:*:*:*:*4.0.12Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.13:*:*:*:*:*:*:*4.0.13Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.14:*:*:*:*:*:*:*4.0.14Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.15:*:*:*:*:*:*:*4.0.15Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.16:*:*:*:*:*:*:*4.0.16Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.17:*:*:*:*:*:*:*4.0.17Vulnerablenetty
cpe:2.3:a:netty:netty:4.0.18:*:*:*:*:*:*:*4.0.18Vulnerablenetty
  • cpe:2.3:a:netty:netty:3.8.0:*:*:*:*:*:*:* Versions 3.8.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.8.1:*:*:*:*:*:*:* Versions 3.8.1 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.9.0:*:*:*:*:*:*:* Versions 3.9.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.7:*:*:*:*:*:*:* Versions 4.0.7 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.8:*:*:*:*:*:*:* Versions 4.0.8 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.9:*:*:*:*:*:*:* Versions 4.0.9 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.10:*:*:*:*:*:*:* Versions 4.0.10 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.11:*:*:*:*:*:*:* Versions 4.0.11 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.12:*:*:*:*:*:*:* Versions 4.0.12 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.13:*:*:*:*:*:*:* Versions 4.0.13 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.14:*:*:*:*:*:*:* Versions 4.0.14 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.15:*:*:*:*:*:*:* Versions 4.0.15 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.16:*:*:*:*:*:*:* Versions 4.0.16 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.17:*:*:*:*:*:*:* Versions 4.0.17 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:4.0.18:*:*:*:*:*:*:* Versions 4.0.18 Vulnerable ·netty

Remediation

  • Fix · GHSA-7vpq-g998-qpv7 io.netty:netty (Maven) Fixed in 3.6.9.Final Advisory →
  • Fix · GHSA-7vpq-g998-qpv7 io.netty:netty (Maven) Fixed in 3.7.1.Final Advisory →
  • Fix · GHSA-7vpq-g998-qpv7 io.netty:netty (Maven) Fixed in 3.8.2.Final Advisory →
  • Fix · GHSA-7vpq-g998-qpv7 io.netty:netty (Maven) Fixed in 3.9.1.Final Advisory →
  • Fix · GHSA-7vpq-g998-qpv7 io.netty:netty (Maven) Fixed in 4.0.19.Final Advisory →
  • Fix · GHSA-7vpq-g998-qpv7 io.netty:netty-all (Maven) Fixed in 4.0.19.Final Advisory →

Red Hat 12 advisories

  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2
  • RHSA-2015:0765 Released 2015-03-31 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.0.0 security update
    • Red Hat JBoss Data Virtualization 6.0
  • RHSA-2015:0720 Released 2015-03-24 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
Show 9 more Red Hat advisories
  • RHSA-2015:0675 Released 2015-03-11 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.1.0 update
    • Red Hat JBoss Data Virtualization 6.1
  • RHSA-2015:0234 Released 2015-02-17 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 security update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2015:0235 Released 2015-02-17 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 security update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:1351 Released 2014-10-01 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.1.0 security update
    • Red Hat JBoss A-MQ 6.1
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:1019 Released 2014-08-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.0 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server apache-commons-beanutils-eap6-1.8.3-7.redhat_6.1.ep6.el5, apache-commons-cli-eap6-1.2-6.redhat_4.1.ep6.el5, apache-commons-codec-eap6-1.4-16.redhat_3.1.ep6.el5 +47
  • RHSA-2014:1020 Released 2014-08-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.0 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server apache-commons-beanutils-eap6-1.8.3-7.redhat_6.1.ep6.el6, apache-commons-cli-eap6-1.2-6.redhat_4.1.ep6.el6, apache-commons-codec-eap6-1.4-16.redhat_3.1.ep6.el6 +47
  • RHSA-2014:1021 Released 2014-08-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.3.0 update
    • Red Hat JBoss Enterprise Application Platform 6.3
  • RHSA-2014:0910 Released 2014-07-21 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.2.2 update
    • Red Hat JBoss Operations Network 3.2
  • RHSA-2014:0818 Released 2014-06-30 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.2 update
    • Red Hat JBoss BRMS 6.0

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:1351
Red Hat JBoss BPMS 6.0Fixed RHSA-2015:0234
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0818
Red Hat JBoss Data Virtualization 6.0Fixed RHSA-2015:0765
Red Hat JBoss Data Virtualization 6.1Fixed RHSA-2015:0675
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2014:1019
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2014:1020
Red Hat JBoss Enterprise Application Platform 6.3Fixed RHSA-2014:1021
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:1351
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2015:0720
Red Hat JBoss Operations Network 3.2Fixed RHSA-2014:0910
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009
Not affected: 1 product
  • Red Hat JBoss Data Grid 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0193
  2. 2026-10-03 Alias added: GHSA-7vpq-g998-qpv7

References

Patch 1

Advisory 8

Other 9

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences