| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty | ≥ 3.3.0.Final, ≤ 4.0.0.Alpha8 | |
| io.netty:netty-all | ≥ 4.0.0.Beta1, < 4.1.42.Final | 4.1.42.Final |
| org.jboss.netty:netty | ≤ 3.2.9.Final | |
| netty | < 4.1.42 | 4.1.42 |
| jboss enterprise application platform | = 7.2= 7.3= 7.4 |
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free