MEDIUM

GHSA-4mp9-239f-g9hg

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Quick fix

GHSA-4mp9-239f-g9hg — io.netty:netty-codec-http: upgrade to the fixed version with the command below.

# pom.xml: bump <version>4.2.16.Final</version> for io.netty:netty-codec-http

Details

## Summary An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / io.netty:netty-codec-http

Introduced in: 4.2.0.Final Fixed in: 4.2.16.Final

Fix # pom.xml: bump <version>4.2.16.Final</version> for io.netty:netty-codec-http

Maven / io.netty:netty-codec-http

Introduced in: 0 Fixed in: 4.1.136.Final

Fix # pom.xml: bump <version>4.1.136.Final</version> for io.netty:netty-codec-http

Details

Are you affected?

Affected packages

References