CVE-2022-41915CWE-113CWE-436

Netty project is an event-driven asynchronous network application framework

Medium · published December 13, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00952 · 60.9th percentile
Weaknesses
CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'); CWE-436 · Interpretation Conflict
Published
2022-12-13T00:00Z
EPSS history
Timeline
  • 13 DEC 00:00Z
    Netty project is an event-driven asynchronous network application framework
    cvelistv5