Vulnerability in io.netty:netty-codec-haproxy (CVE-2022-41881)
Summary
Vulnerability in io.netty:netty-codec-haproxy (CVE-2022-41881). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.1.86.Final or later.
Original description
The description as published by the source.
Impact
A StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion.
Patches
Users should upgrade to 4.1.86.Final.
Workarounds
There is no workaround, except using a custom HaProxyMessageDecoder.
References
When parsing a TLV with type = PP2_TYPE_SSL, the value can be again a TLV with type = PP2_TYPE_SSL and so on.
The only limitation of the recursion is that the TLV length cannot be bigger than 0xffff because it is encoded in an unsigned short type.
Providing a TLV with a nesting level that is large enough will lead to raising of a StackOverflowError.
The StackOverflowError will be caught if HAProxyMessageDecoder is used as part of Netty’s ChannelPipeline, but using it directly without the ChannelPipeline will lead to a thrown exception / crash.
For more information
If you have any questions or comments about this advisory:
- Open an issue in netty
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2022-41881 has been found in io.netty:netty-codec-haproxy.
Risk of unauthorized operations or information disclosure.
What to do: upgrade io.netty:netty-codec-haproxy to 4.1.86.Final or later.
If unsure, ask your IT team or search "io.netty:netty-codec-haproxy CVE-2022-41881" on the vendor's site.
CVE-2022-41881 (io.netty:netty-codec-haproxy) — CWE-674
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 4.1.86.Final — apply immediately
Workaround: There is no workaround, except using a custom HaProxyMessageDecoder.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-674) exists in io.netty:netty-codec-haproxy.
Check the vendor advisory for the affected versions of io.netty:netty-codec-haproxy.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 4.1.86.Final.
Workaround: There is no workaround, except using a custom HaProxyMessageDecoder.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで io.netty:netty-codec-haproxy を使っているサービスとバージョンを洗い出す。
-
2Apply temporary workaround mitigate
There is no workaround, except using a custom HaProxyMessageDecoder.パッチが適用されるまでの応急処置として、There is no workaround, except using a custom HaProxyMessageDecoder. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade io.netty:netty-codec-haproxy to 4.1.86.Finalステージング環境で 4.1.86.Final に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-41881 netty Fixed in: 1:4.1.48-4+deb11u1
- Ubuntu UBUNTU-CVE-2022-41881 netty
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web lists.debian.org
- web security.netapp.com
- web debian.org