CVE-2024-29025 Netty HttpPostRequestDecoder can OOM
Attackers can cause Out-of-Memory errors in Netty's HttpPostRequestDecoder by sending many small fields, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29025?
CVE-2024-29025 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.
Weakness: CWE-770
Which versions are affected by CVE-2024-29025?
2 open source packages ship an affected version, including io.netty:netty-codec-http. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-codec-http Maven | All versions | 4.1.108.Final |
io.netty:netty-codec-http Maven | All versions | 4.1.108.Final |
Linux distribution packages (35)
netty-tcnative SUSE:Enterprise Storage 7.1 | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Enterprise Storage 7.1 | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Module for Development Tools 15 SP5 | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Module for Development Tools 15 SP5 | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 3.10.6-150200.3.10.1 |
netty SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 4.1.108-150200.4.23.1 |
netty SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 4.1.108-150200.4.23.1 |
netty-tcnative SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 3.10.6-150200.3.10.1 |
netty-tcnative SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 2.0.65-150200.3.19.1 |
netty3 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.10.6-150200.3.10.1 |
netty openSUSE:Leap 15.5 | All versions | 4.1.108-150200.4.23.1 |
netty-tcnative openSUSE:Leap 15.5 | All versions | 2.0.65-150200.3.19.1 |
netty3 openSUSE:Leap 15.5 | All versions | 3.10.6-150200.3.10.1 |
netty openSUSE:Leap 15.6 | All versions | 4.1.108-150200.4.23.1 |
netty-tcnative openSUSE:Leap 15.6 | All versions | 2.0.65-150200.3.19.1 |
netty3 openSUSE:Leap 15.6 | All versions | 3.10.6-150200.3.10.1 |
netty3 openSUSE:Tumbleweed | All versions | 3.10.6-17.1 |
Products include Debian Debian Linux, Netty Netty.
How do I fix CVE-2024-29025?
Upgrade io.netty:netty-codec-http to 4.1.108.Final or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-29025 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29025 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-BY12849, CLEANSTART-2026-SP00436, CLEANSTART-2026-VN95334, DEBIAN-CVE-2024-29025, DLA-3834-1, ECHO-1017-98f0-c148 and 11 more.