Netty-Incubator-Codec-Ohttp vulnerabilitiesRanked by how likely they are to be used.
Netty-Incubator-Codec-Ohttp is made by Netty. We track 2 published vulnerabilities in it, across 19 versions. None of them is on the list of flaws known to be exploited today. If you run Netty-Incubator-Codec-Ohttp, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Netty-Incubator-Codec-Ohttp vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Netty-Incubator-Codec-Ohttp's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Netty-Incubator-Codec-Ohttp flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 0.7%CVE-2024-40642High
The netty incubator codec.bhttp is a java language binary http parser.
- 0.3%CVE-2024-36121Medium
netty-incubator-codec-ohttp is the OHTTP implementation for netty.
Running Netty-Incubator-Codec-Ohttp? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly validate input values thus giving attackers almost complete control over the HTTP requests constructed from the parsed output. Attackers can abuse several issues individually to perform various injection attacks including HTTP request smuggling, desync attacks, HTTP header injections, request queue poisoning, caching attacks and Server Side Request Forgery (SSRF). Attacker could also combine several issues to create well-formed messages for other text-based protocols which may result in attacks beyond the HTTP protocol. The BinaryHttpParser class implements the readRequestHead method which performs most of the relevant parsing of the received request. The data structure prefixes values with a variable length integer value. The parsing code below first gets the lengths of the values from the prefixed variable length integer. After it has all of the lengths and calculates all of the indices, the parser casts the applicable slices of the ByteBuf to String. Finally, it passes these values into a new `DefaultBinaryHttpRequest` object where no further parsing or validation occurs. Method is partially validated while other values are not validated at all. Software that relies on netty to apply input validation for binary HTTP data may be vulnerable to various injection and protocol based attacks. This issue has been addressed in version 0.0.13.Final. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Matched to
- Netty-Incubator-Codec-Ohttp on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 2 published vulnerabilities listed under the name Netty-Incubator-Codec-Ohttp, across 19 versions.
None of Netty-Incubator-Codec-Ohttp's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Netty-Incubator-Codec-Ohttp. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.