Read the docs
TI-2022-20222 Aliases CVE-2022-41881GHSA-fx2c-96vj-985v

Uncontrolled recursion in netty

Priority HIGH 72CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 19 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01577 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.1.86.Finalio.netty:netty-codec-haproxy (Maven): 4.1.86.FinalRed Hat: 20 advisoriesRed Hat: 19 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.86.Final4.1.86.FinalPatch availableCNA
—io.netty:netty-codec-haproxy (Maven)before 4.1.86.Final4.1.86.FinalPatch availableGHSA-fx2c-96vj-985v
  • netty Vendornetty Affected before 4.1.86.Final Fixed in 4.1.86.Final Patch available CNA
  • io.netty:netty-codec-haproxy (Maven) Vendor— Affected before 4.1.86.Final Fixed in 4.1.86.Final Patch available GHSA-fx2c-96vj-985v

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.86Vulnerablenetty
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.86 Vulnerable ·netty
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.86.Final
  • Fix · GHSA-fx2c-96vj-985v io.netty:netty-codec-haproxy (Maven) Fixed in 4.1.86.Final Advisory →

Red Hat 20 advisories

  • RHSA-2025:1747 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.12 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
  • RHSA-2025:1746 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
  • RHSA-2023:4627 Released 2023-08-14 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
Show 17 more Red Hat advisories
  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
  • RHSA-2023:3373 Released 2023-05-31 · Red Hat rating Moderate
    Migration Toolkit for Runtimes security update
    • Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8
  • RHSA-2023:3374 Released 2023-05-31 · Red Hat rating Moderate
    Migration Toolkit for Runtimes security update
    • Migration Toolkit for Runtimes 1 on RHEL 8
  • RHSA-2023:2710 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:2713 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:2706 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el8sso
  • RHSA-2023:2707 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el9sso
  • RHSA-2023:2705 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el7sso
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1
  • RHSA-2023:1516 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 security update
    • Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
  • RHSA-2023:1512 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
  • RHSA-2023:1513 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
  • RHSA-2023:1514 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
  • RHSA-2023:0888 Released 2023-02-21 · Red Hat rating Moderate
    Red Hat Integration Camel Extension For Quarkus 2.13.2-1 security update
    • CEQ 2.13.2-1
  • RHSA-2023:0577 Released 2023-02-16 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.3.7 security update
    • Red Hat build of Eclipse Vert.x 4.3.7
  • RHSA-2023:0758 Released 2023-02-14 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.13.7 release and security update
    • Red Hat build of Quarkus
  • RHSA-2023:0713 Released 2023-02-09 · Red Hat rating Important
    Red Hat Data Grid 8.4.1 security update
    • Red Hat Data Grid 8.4.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix planned: Will not fix
Migration Toolkit for Applications 6AffectedNo fix yet
Migration Toolkit for RuntimesAffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of Debezium 1AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
CEQ 2.13.2-1Fixed RHSA-2023:0888
MTA 6.2 for RHEL 8Fixed RHSA-2023:4627
Middleware Containers for OpenShiftFixed RHSA-2023:2710
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2023:3373, RHSA-2023:3374
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
Red Hat Data Grid 8.4.1Fixed RHSA-2023:0713
Red Hat Fuse 7.12Fixed RHSA-2023:3954
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:1512
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:1513
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:1514
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:1516
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:1747
Red Hat Single Sign-On 7Fixed RHSA-2023:2713
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:2705
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:2706
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:2707
Red Hat build of Eclipse Vert.x 4.3.7Fixed RHSA-2023:0577
Red Hat build of QuarkusFixed RHSA-2023:0758
Not affected: 7 products
  • Logging Subsystem for Red Hat OpenShift
  • MTA 6.2 for RHEL 8
  • Migration Toolkit for Runtimes 1 on RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41881
  2. 2026-10-03 Alias added: GHSA-fx2c-96vj-985v
  3. 2026-11-05 Affected versions changed · Red Hat

References

Exploit 1

Advisory 4

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences