Netty HttpServerCodec HTTP/1.1 Pipelining Unbounded Queue Memory Exhaustion Vulnerability

Netty Vulnerability Summary Vulnerability Overview Vulnerability Name: Netty: [HttpServerCodec] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Severity: High CVE ID: No known CVE Weakness Type: CWE-770 Vulnerability Description: - tracks each HTTP method per connection, with each incomplete pipelined request consuming one entry. - The first 32 pending entries are packed into a long, but every entry beyond this limit overflows into (an unbounded ). - A remote unauthenticated attacker can exploit this vulnerability by sending an unlimited number of pipelined requests on a single connection while reading from the socket, causing the queue to grow without limit and resulting in uncontrolled memory growth. - This is the same class of defect fixed in (CVE-2020-9489), but is a more fundamental and widely used class that never received an equivalent fix. Affected Scope Affected Versions: - - - Fixed Versions: - - - Remediation Recommended Fix: Add a boundary similar to (reject requests once the configurable limit is reached) for 's , which is already used in , and consider applying the same fix to similar unbounded queues in . POC Code Verification Methods 1. Isolated Reproduction: / run independently. 50,000,000 unconditional calls resulted in zero exceptions. The grew after every 40,999,968 entries, with heap growth of -272MB in local testing. 2. End-to-End Reproduction: Against real, unmodified, currently HEAD-compiled classes, driving the pipeline via real HTTP/1.1 byte stream decoding using : Sent 50,000 pipelined minimal GET requests without writing any outbound data within 100 or 5,000 iterations (simulating cross-connection reads). Result: The overflow queue filled up to 32 per batch, (checked via reflection) grew to 499,968 per batch, with zero exceptions or checkpoints reached - completed within 300ms. 3. Confirm Decoding Pipeline Independence from Real World: A synchronous echo handler with zero application delay can print that the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was never released, because the queue was neve

Goal Reached Thanks to every supporter — we hit 100%!

Netty HttpServerCodec HTTP/1.1 Pipelining Unbounded Queue Memory Exhaustion Vulnerability

More from this source