DescriptionNetty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3268-1, DSA-5316-1
Debian Bugs1027180

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
netty (PTS)jessie, jessie (lts)1:3.2.6.Final-2+deb8u2fixed
stretch (security)1:4.1.7-2+deb9u3fixed
stretch (lts), stretch1:4.1.7-2+deb9u4fixed
buster (security)1:4.1.33-1+deb10u4fixed
bullseye (security), bullseye1:4.1.48-4+deb11u2fixed
bookworm (security), bookworm1:4.1.48-7+deb12u1fixed
sid, trixie1:4.1.48-9fixed
netty-3.9 (PTS)jessie, jessie (lts)3.9.0.Final-1+deb8u2fixed
stretch (security)3.9.9.Final-1+deb9u1fixed
stretch (lts), stretch3.9.9.Final-1+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nettysourcejessie(not affected)
nettysourcestretch(not affected)
netty-3.9source(unstable)(not affected)

Fixed by (netty-4.1.86.Final)
[stretch] - netty <not-affected> (PROXY Protocol TLV support introduced in v4.1.12)
[jessie] - netty <not-affected> (PROXY Protocol TLV support introduced in v4.1.12)
- netty-3.9 <not-affected> (PROXY Protocol TLV support introduced in v4.1.12)

Search for package or bug name: Reporting problems