Read the docs
TI-2024-19207 Aliases CVE-2024-29025GHSA-5jpm-x58v-624v

Netty HttpPostRequestDecoder can OOM

Priority MEDIUM 63CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 19 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0138 72nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial netty (netty): 4.1.108.Finalio.netty:netty-codec-http (Maven): 4.1.108.FinalRed Hat: 19 advisoriesRed Hat: 19 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.108.Final4.1.108.FinalPatch availableCNA
—io.netty:netty-codec-http (Maven)before 4.1.108.Final4.1.108.FinalPatch availableGHSA-5jpm-x58v-624v
  • netty Vendornetty Affected before 4.1.108.Final Fixed in 4.1.108.Final Patch available CNA
  • io.netty:netty-codec-http (Maven) Vendor— Affected before 4.1.108.Final Fixed in 4.1.108.Final Patch available GHSA-5jpm-x58v-624v

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.108Vulnerablenetty
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.108 Vulnerable ·netty
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.108.Final
  • Fix · GHSA-5jpm-x58v-624v io.netty:netty-codec-http (Maven) Fixed in 4.1.108.Final Advisory →

Red Hat 19 advisories

  • RHSA-2024:9571 Released 2024-11-13 · Red Hat rating Moderate
    Streams for Apache Kafka 2.8.0 release and security update
    • Streams for Apache Kafka 2.8.0
  • RHSA-2024:6657 Released 2024-09-12 · Red Hat rating Moderate
    Migration Toolkit for Runtimes security, bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8
  • RHSA-2024:5479 Released 2024-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.3 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.21.0-5.redhat_00052.1.el8eap, eap8-activemq-artemis-cli-2.21.0-5.redhat_00052.1.el8eap, eap8-activemq-artemis-commons-2.21.0-5.redhat_00052.1.el8eap +47
Show 16 more Red Hat advisories
  • RHSA-2024:5481 Released 2024-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.3 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.21.0-5.redhat_00052.1.el9eap, eap8-activemq-artemis-cli-2.21.0-5.redhat_00052.1.el9eap, eap8-activemq-artemis-commons-2.21.0-5.redhat_00052.1.el9eap +47
  • RHSA-2024:5482 Released 2024-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.3 Security update
    • Red Hat JBoss Enterprise Application Platform 8
  • RHSA-2024:5147 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss Enterprise Application Platform io.netty.netty-codec-http-4.1.108.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.33.SP1-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.78.1.redhat-00002.pom
  • RHSA-2024:5144 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-bouncycastle-1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el8eap +47
  • RHSA-2024:5143 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-bouncycastle-1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el7eap +47
  • RHSA-2024:5145 Released 2024-08-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.18 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-bouncycastle-1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el9eap +47
  • RHSA-2024:4884 Released 2024-07-25 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
    • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
  • RHSA-2024:4460 Released 2024-07-10 · Red Hat rating Important
    Red Hat Data Grid 8.5.0 security update
    • Red Hat Data Grid
  • RHSA-2024:4028 Released 2024-06-20 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.33.0 security update & enhancements
    • Red Hat OpenShift Serverless 1.33 openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8 +33
  • RHSA-2024:3550 Released 2024-06-03 · Red Hat rating Important
    HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO 4.0.0 for Red Hat build of Apache Camel 4
  • RHSA-2024:3527 Released 2024-05-30 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.7.0 release and security update
    • Red Hat AMQ Streams 2.7.0
  • RHSA-2024:2945 Released 2024-05-21 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.0 release and security update
    • Red Hat AMQ Broker 7
  • RHSA-2024:2833 Released 2024-05-14 · Red Hat rating Moderate
    Service Registry (container images) release and security update [2.5.11 GA]
    • RHINT Service Registry 2.5.11 GA
  • RHSA-2024:2705 Released 2024-05-09 · Red Hat rating Moderate
    Red Hat build of Quarkus 3.2.12 release and security update
    • Red Hat build of Quarkus 3.2.12.Final io.netty.netty-codec-http-4.1.108.Final-redhat-00001.jar, io.quarkus.quarkus-core-3.2.12.Final-redhat-00001.jar
  • RHSA-2024:2106 Released 2024-05-07 · Red Hat rating Moderate
    Red Hat build of Quarkus 3.8.4 release
    • Red Hat build of Quarkus 3.8.4.redhat io.netty.netty-codec-http-4.1.108.Final-redhat-00001.jar, io.quarkus.quarkus-core-3.8.4.redhat-00002.jar
  • RHSA-2024:2088 Released 2024-04-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 2AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix planned: Out of support scope
Red Hat build of Debezium 2AffectedNo fix yet
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix planned: Out of support scope
Cryostat 2 on RHEL 8Fixed RHSA-2024:2088
HawtIO 4.0.0 for Red Hat build of Apache Camel 4Fixed RHSA-2024:3550
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2024:6657
RHINT Service Registry 2.5.11 GAFixed RHSA-2024:2833
Red Hat AMQ Broker 7Fixed RHSA-2024:2945
Red Hat AMQ Streams 2.7.0Fixed RHSA-2024:3527
Red Hat Data GridFixed RHSA-2024:4460
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2024:5143
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2024:5144
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2024:5145
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2024:5479
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2024:5481
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2024:5147
Red Hat JBoss Enterprise Application Platform 8Fixed RHSA-2024:5482
Red Hat OpenShift Serverless 1.33Fixed RHSA-2024:4028
Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2Fixed RHSA-2024:4884
Red Hat build of Quarkus 3.2.12.FinalFixed RHSA-2024:2705
Red Hat build of Quarkus 3.8.4.redhatFixed RHSA-2024:2106
Streams for Apache Kafka 2.8.0Fixed RHSA-2024:9571
Not affected: 9 products
  • A-MQ Clients 2
  • Red Hat AMQ Clients
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss EAP 8.0 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat build of Quarkus 3.2.12.Final
  • Red Hat build of Quarkus 3.8.4.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29025
  2. 2026-10-03 Alias added: GHSA-5jpm-x58v-624v
  3. 2026-11-07 Affected versions changed · Red Hat

References

Exploit 2

Patch 1

Advisory 2

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences