CVE-2024-29025

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.108.Final

Description The issue is related to the HttpPostRequestDecoder in Netty, which can be tricked to accumulate data without limits. This can be achieved by sending a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list, or by cumulating bytes in the undecodedChunk buffer until a field can be decoded. The vulnerability can be exploited to cause a denial of service.

Recommendations For Netty versions prior to 4.1.108.Final, update to version 4.1.108.Final or later to resolve the issue. As a temporary workaround, consider restricting the number of fields that can be accumulated in the bodyListHttpData list or limiting the size of the undecodedChunk buffer to prevent excessive data accumulation.