Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade netty | Jan 13, 2023 | Dec 12, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Dec 12, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Dec 12, 2022 |
| Suse | — | Upgrade netty-pomsUpgrade netty-tcnativeUpgrade netty-tcnative-javadocUpgrade netty-javadocUpgrade netty | May 5, 2023 | Dec 12, 2022 |
| Ubuntu | — | Upgrade libnetty-javaUpgrade libnetty-java (Ubuntu Pro) | May 1, 2023 | Dec 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub