| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty | all versions | |
| io.netty:netty-codec-http | < 4.1.44 | 4.1.44 |
| org.jboss.netty:netty | all versions | |
| netty | < 4.1.44 | 4.1.44 |
| jboss amq clients | = 2 | |
| jboss enterprise application platform | = 7.2= 7.3 |
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free