| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty | ≥ 3.6.0.Beta1, < 3.6.9.Final≥ 3.7.0.Final, < 3.7.1.Final≥ 3.8.0.Final, < 3.8.2.Final≥ 3.9.0.Final, < 3.9.1.Final≥ 4.0.0.Alpha1, < 4.0.19.Final | 3.6.9.Final3.7.1.Final3.8.2.Final3.9.1.Final4.0.19.Final |
| io.netty:netty-all | ≥ 4.0.0.Alpha1, < 4.0.19.Final | 4.0.19.Final |
| netty | = 3.6.0= 3.6.1= 3.6.2= 3.6.3= 3.6.4= 3.6.5= 3.6.6= 3.6.7= 3.6.8= 3.7.0= 3.8.0= 3.8.1= 3.9.0= 4.0.0= 4.0.1= 4.0.10= 4.0.11= 4.0.12= 4.0.13= 4.0.14= 4.0.15= 4.0.16= 4.0.17= 4.0.18= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.0.8= 4.0.9 |
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free