Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]
Recommended action: Upgrade to 4.1.136.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. Details io.netty.handler.codec.compression.Lz4FrameDecoder#decode Header fields are trusted for sizing. On the compressed path, after readableBytes = compressedLength, the decoder does ctx.alloc().buffer(decompressedLength, decompressedLength) then decompresses. PoC The test below demonstrates how an attacker sending 22 bytes will force the server to allocate 32MB Impact Untrusted senders without per-channel / aggregate limits can stress memory with many small requests.
Recommended action: Upgrade to 4.1.133.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is basically a zip bomb. Tested on 4.1.118, but there were no changes to the decoder since. PoC Run this test case with -Xmx1G: Error: Impact DoS for anyone using BrotliDecoder on untrusted input.
Recommended action: Upgrade to 4.1.125.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.