CVE-2022-41915
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.9%
exploitation probability
0.9%top 43% of all CVEs
observed exploitation
nono source reports it
In short
Netty's HTTP header handling fails to validate values when using an iterator, allowing attackers to inject malicious headers that split HTTP responses and potentially hijack user sessions or inject malicious content.
Technical detail
CVE-2022-41915 affects Netty 4.1.83.Final through 4.1.85.Final where DefaultHttpHeaders.set() with an Iterator parameter lacks proper header value sanitization (CWE-113). An attacker can supply crafted header values containing CRLF sequences via iterator-based API calls to perform HTTP Response Splitting (CWE-436), bypassing validation that occurs in other code paths. Patched in 4.1.86.Final.
Summary generated and translated by AI from the official description.
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
netty · nettyReferences
https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4https://github.com/netty/netty/issues/13084https://github.com/netty/netty/pull/12760https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frphttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20230113-0004/https://www.debian.org/security/2023/dsa-5316