CVE-2022-41881

NameCVE-2022-41881
DescriptionNetty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3268-1, DSA-5316-1
Debian Bugs1027180

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
netty (PTS)jessie, jessie (lts)1:3.2.6.Final-2+deb8u2fixed
stretch (security)1:4.1.7-2+deb9u3fixed
stretch (lts), stretch1:4.1.7-2+deb9u5fixed
buster (security), buster, buster (lts)1:4.1.33-1+deb10u5fixed
bullseye (security), bullseye1:4.1.48-4+deb11u2fixed
bookworm (security), bookworm1:4.1.48-7+deb12u1fixed
sid, trixie1:4.1.48-10fixed
netty-3.9 (PTS)jessie, jessie (lts)3.9.0.Final-1+deb8u2fixed
stretch (security)3.9.9.Final-1+deb9u1fixed
stretch (lts), stretch3.9.9.Final-1+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nettysourcejessie(not affected)
nettysourcestretch(not affected)
nettysourcebuster1:4.1.33-1+deb10u3DLA-3268-1
nettysourcebullseye1:4.1.48-4+deb11u1DSA-5316-1
nettysource(unstable)1:4.1.48-61027180
netty-3.9source(unstable)(not affected)

Notes

https://github.com/netty/netty/security/advisories/GHSA-fx2c-96vj-985v
Fixed by https://github.com/netty/netty/commit/cd91cf3c99123bd1e53fd6a1de0e3d1922f05bb2 (netty-4.1.86.Final)
[stretch] - netty <not-affected> (PROXY Protocol TLV support introduced in v4.1.12)
[jessie] - netty <not-affected> (PROXY Protocol TLV support introduced in v4.1.12)
- netty-3.9 <not-affected> (PROXY Protocol TLV support introduced in v4.1.12)

Search for package or bug name: Reporting problems