Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Vulnerability Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Vulnerability Title
Netty 环境问题漏洞
Vulnerability Description
Netty是Netty社区的一款非阻塞I/O客户端-服务器框架，它主要用于开发Java网络应用程序，如协议服务器和客户端等。 Netty 存在环境问题漏洞，该漏洞源于Netty是一个异步事件驱动的网络应用框架，用于快速开发可维护的高性能协议服务器和客户端。版本4.1.7.1之前的Netty。当控件字符出现在头名称的开头和结尾时，Final将跳过它们。相反，它应该很快失败，因为这是规范不允许的，可能会导致HTTP请求走私。如果没有进行验证，netty可能会在将这些头名称转发给另一个用作代理的远程系统之前对其
CVSS Information
N/A
Vulnerability Type
N/A