CyberRota Analysis
AI-GeneratedThe vulnerability affects Netty's HttpServerCodec in specific versions, where improper handling of HTTP/1.1 requests can lead to response splitting and unsafe connection reuse. This occurs when a client sends a pipelined GET request with an Expect: 100-continue header, causing the server to mispair responses, ultimately dropping the intended GET response body. Organizations utilizing affected versions of Netty in their applications should prioritize patching to versions 4.2.17.Final or 4.1.137.Final to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.