Netty HTTP Framing Flaw: Conflict Between Transfer-Encoding and Content-Length Headers

Vulnerability Overview This commit fixes a defect in the validation of HTTP/1.1 request framing (Transfer-Encoding framing). In older versions of Netty, there was a vulnerability in the validation logic for the header: when a request carries both and headers, the legacy code only validated the legality of but failed to validate the compatibility between and , potentially leading to framing parsing errors. Scope of Impact Affected Components: and its subclasses (e.g., , ). Affected Versions: Netty versions prior to the fix (specific version numbers need to be confirmed against Netty's release history, typically affecting the 4.1.x series). Trigger Conditions: HTTP/1.1 requests that simultaneously include and headers, or cases where the value is invalid (e.g., not , not , etc.). Fix Details 1. Enhanced Validation Logic: Added joint validation for and in to ensure there are no conflicts between the two. 2. New Methods: - : Validates whether the last value in is . - : Validates whether contains . - : Validates whether is a valid integer. 3. Exception Handling: Throws an or when validation fails, clearly indicating the cause of the error. POC/Exploit Code ```java // Test case: Invalid Transfer-Encoding values @Test public void testInvalidTransferEncoding() { String[] invalidTransferEncodings = { "Transfer-Encoding: chunked, identity\r\nContent-Length: 1\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chunked, gzip, chunked\r\n", "Transfer-Encoding: chunked, gzip\r\n", "Transfer-Encoding: chu

Goal Reached Thanks to every supporter — we hit 100%!

Netty HTTP Framing Flaw: Conflict Between Transfer-Encoding and Content-Length Headers

More from this source