Impact
When calling DefaultHttpHeaders.set
with an iterator of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting.
Patches
The necessary validation was added in Netty 4.1.86.Final.
Workarounds
Integrators can work around the issue by changing the DefaultHttpHeaders.set(CharSequence, Iterator<?>)
call, into a remove()
call, and call add()
in a loop over the iterator of values.
References
HTTP Response Splitting
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
For more information
If you have any questions or comments about this advisory:
Impact
When calling
DefaultHttpHeaders.set
with an iterator of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting.Patches
The necessary validation was added in Netty 4.1.86.Final.
Workarounds
Integrators can work around the issue by changing the
DefaultHttpHeaders.set(CharSequence, Iterator<?>)
call, into aremove()
call, and calladd()
in a loop over the iterator of values.References
HTTP Response Splitting
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
For more information
If you have any questions or comments about this advisory: