Vulnerability · Published May 6, 2022 · Assigned by GitHub_M

CVE-2022-24823Local Information Disclosure Vulnerability in io.netty:netty-codec-http

Medium 5.5

In plain English

A medium-severity security flaw in netty from netty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)1.0%top 35.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netty	no fix listed	DEBIAN-CVE-2022-24823
Debian:13	netty	no fix listed	DEBIAN-CVE-2022-24823
Debian:14	netty	no fix listed	DEBIAN-CVE-2022-24823
Maven	io.netty:netty-codec-http	4.1.77.Final	GHSA-269q-hmxg-m83q
Ubuntu:25.10	netty	no fix listed	UBUNTU-CVE-2022-24823
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2022-24823

Affected products (as reported)

Vendor	Product	Versions
netty	netty	<= 4.1.76.Final

Weakness: CWE-668, CWE-378, CWE-379 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q x_refsource_CONFIRM
https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 x_refsource_MISC
https://github.com/netty/netty/commit/185f8b2756a36aaa4f973f1a2a025e7d981823f1 x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220616-0004/ x_refsource_CONFIRM