Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Priority MEDIUM 58CWE-378Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 10 fixed, 14 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-668 and the CVSS impact.
Summary
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01044 64th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial io.netty:netty-codec-http (Maven): 4.1.77.FinalRed Hat: 10 advisoriesRed Hat: 10 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | up to 4.1.76.Final | — | No fix listed | CNA |
| — | io.netty:netty-codec-http (Maven) | before 4.1.77.Final | 4.1.77.Final | Patch available | GHSA-269q-hmxg-m83q |
- netty Vendornetty Affected up to 4.1.76.Final Fixed in — No fix listed CNA
- io.netty:netty-codec-http (Maven) Vendor— Affected before 4.1.77.Final Fixed in 4.1.77.Final Patch available GHSA-269q-hmxg-m83q
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* | before 4.1.77 | Vulnerable | netty |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.77 Vulnerable ·netty
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-269q-hmxg-m83q io.netty:netty-codec-http (Maven) Fixed in 4.1.77.Final Advisory →
Red Hat 10 advisories
- RHSA-2023:5165 Released 2023-09-14 · Red Hat rating ImportantRed Hat AMQ Streams 2.5.0 release and security update
- Red Hat AMQ Streams 2.5.0
- RHSA-2023:3223 Released 2023-05-18 · Red Hat rating ImportantRed Hat AMQ Streams 2.4.0 release and security update
- Red Hat AMQ Streams 2.4.0
- RHSA-2022:8652 Released 2022-11-28 · Red Hat rating ImportantRed Hat Fuse 7.11.1 release and security update
- Red Hat Fuse 7.11.1
Show 7 more Red Hat advisories
- RHSA-2022:8524 Released 2022-11-17 · Red Hat rating ImportantRed Hat Data Grid 8.4.0 security update
- Red Hat Data Grid 8.4.0
- RHSA-2022:6916 Released 2022-10-12 · Red Hat rating ImportantRed Hat AMQ Broker 7.10.1 release and security update
- AMQ Broker 7.10.1
- RHSA-2022:6819 Released 2022-10-05 · Red Hat rating ImportantRed Hat AMQ Streams 2.2.0 release and security update
- Red Hat AMQ Streams 2.2.0
- RHSA-2022:5928 Released 2022-08-08 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss Enterprise Application Platform com.google.code.gson.gson-2.8.9.redhat-00001.jar, io.netty.netty-codec-http-4.1.77.Final-redhat-00001.jar, org.jboss.hal.hal-console-3.3.13.Final-redhat-00001-resources.jar
- RHSA-2022:5894 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update.
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-1-18.el9eap, eap7-FastInfoset-1.2.13-11.1.redhat_1.1.el9eap, eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el9eap +47
- RHSA-2022:5892 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-gson-2.8.9-1.redhat_00001.1.el7eap, eap7-hal-console-3.3.13-1.Final_redhat_00001.1.el7eap, eap7-netty-4.1.77-1.Final_redhat_00001.1.el7eap +27
- RHSA-2022:5893 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-gson-2.8.9-1.redhat_00001.1.el8eap, eap7-hal-console-3.3.13-1.Final_redhat_00001.1.el8eap, eap7-netty-4.1.77-1.Final_redhat_00001.1.el8eap +27
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| AMQ Broker 7.10.1 | Fixed | RHSA-2022:6916 |
| Red Hat AMQ Streams 2.2.0 | Fixed | RHSA-2022:6819 |
| Red Hat AMQ Streams 2.4.0 | Fixed | RHSA-2023:3223 |
| Red Hat AMQ Streams 2.5.0 | Fixed | RHSA-2023:5165 |
| Red Hat Data Grid 8.4.0 | Fixed | RHSA-2022:8524 |
| Red Hat Fuse 7.11.1 | Fixed | RHSA-2022:8652 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2022:5892 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2022:5893 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2022:5894 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2022:5928 |
Not affected: 7 products
- A-MQ Clients 2
- Red Hat A-MQ Online
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat OpenShift Application Runtimes
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24823
- 2026-10-03 Alias added: GHSA-269q-hmxg-m83q
References
Exploit 2
Patch 2
Advisory 2
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2022-24823 · CVE Program
- CVE-2022-24823 · NVD
- FIRST EPSS
- GHSA-269q-hmxg-m83q · GitHub Advisory Database · CC BY 4.0
- CVE-2022-24823 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences