Red Hat Amq Clients
Monthly
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. Real security impact is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer must parse the RTSP method differently from Netty for method/request smuggling to produce genuine integrity effects, and exposure is narrow because RTSP listeners are far less commonly internet-facing than HTTP. Exploitation status: no public exploit identified at time of analysis and no CISA KEV confirmation, though the upstream advisory itself documents a minimal wire-level reproduction at a high level.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.
HTTP request smuggling in Netty's HTTP/1 decoder lets remote, unauthenticated attackers bypass front-end security controls and reach resources they should not access by sending requests with malformed Transfer-Encoding headers. Netty is a widely embedded Java networking library, so the practical reach spans Red Hat products built on it - AMQ Broker 7, AMQ Clients, Red Hat Build of Keycloak, Red Hat Build of Quarkus, Red Hat Build of Apache Camel (Spring Boot 4 and Quarkus 3), Red Hat Build of Debezium 3, Red Hat Build of Apicurio Registry 3, Red Hat Data Grid 8 and Red Hat Fuse 7 - as well as JBoss EAP 7/8 and Red Hat Single Sign-On 7 per the associated advisory tags. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with smuggling-style control bypass rather than full compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable on any exposed HTTP endpoint.
HTTP request smuggling in Netty's netty-codec-http component lets unauthenticated remote attackers bypass front-end security controls by sending a crafted HTTP/1.1 chunk-size token containing whitespace after the hexadecimal digits, which Netty parses differently from other HTTP intermediaries. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), meaning no authentication or user interaction is required, but integrity and availability impact is limited; meaningful exploitation generally depends on a multi-tier topology where a proxy, load balancer, or backend parses the chunk-size token inconsistently with Netty. Red Hat ships the affected library across a broad portfolio - including AMQ Broker 7, AMQ Clients, Quarkus, Keycloak and Red Hat Single Sign-On 7, JBoss EAP 7/8, Fuse 7, Data Grid 8, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Apicurio Registry 3 and Debezium 3 - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
This is a real but moderate-priority vulnerability whose severity depends almost entirely on deployment topology rather than the raw 6.5 CVSS score. Netty's HTTP decoder lets split or duplicated Transfer-Encoding header fields slip past its final-chunked validation, so an unauthenticated, remote attacker who can send a raw crafted request to a Netty listener that sits in an HTTP chain with a second HTTP parser (reverse proxy, load balancer, CDN, WAF, or upstream/downstream server) can desynchronize the two parsers and smuggle a request (CWE-444). Impact is confined to low confidentiality and integrity loss (C:L/I:L) with no availability impact, no authentication (PR:N) or user interaction (UI:N) is required, and no public exploit identified at time of analysis.
HTTP request smuggling in Netty's HTTP/1.1 decoder (HttpObjectDecoder and the HttpRequestDecoder built on it) lets remote, unauthenticated attackers send a chunk-size line containing an embedded bare carriage return - for example `0\rX` - because strict chunk-line validation is skipped whenever the size line carries no `;` chunk extension, causing a request-boundary desync when Netty shares a connection with a second HTTP intermediary that frames the message differently. The flaw reaches every application and Red Hat product that embeds Netty, including AMQ Broker 7, AMQ Clients, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Keycloak / Red Hat Single Sign-On, JBoss EAP 7 and 8, Fuse 7, Data Grid 8, Apicurio Registry 3 and Debezium 3, while independent assessment keeps it at CVSS 6.5 with AC:H because a standalone Netty service with no disagreeing proxy in the chain yields little practical smuggling impact. The public report includes a reproducible PoC test harness, but there is no CISA KEV listing and no evidence of active exploitation.
Netty's codec-rtsp component silently normalizes away trailing control bytes in RTSP method tokens, so a wire request whose method token ends in a byte with code point <= 0x20 immediately before the separating space (for example PLAY\x00 or PLAY\r) is decoded as a fully successful PLAY request with decoderResult().isSuccess() == true and request.method() referencing the same cached singleton object, leaving the application layer unable to distinguish it from a clean PLAY. This is a remote, unauthenticated, low-complexity integrity flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting any product that embeds Netty and exposes an RTSP listener, including the Red Hat components named in the advisory such as AMQ Broker 7, AMQ Clients, Quarkus, Camel for Quarkus 3/Spring Boot 4, Keycloak, JBoss EAP 7/8, Single Sign-On 7, Data Grid 8, Fuse 7, Debezium 3, and Apicurio Registry 3. Real security impact is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer must parse the RTSP method differently from Netty for method/request smuggling to produce genuine integrity effects, and exposure is narrow because RTSP listeners are far less commonly internet-facing than HTTP. Exploitation status: no public exploit identified at time of analysis and no CISA KEV confirmation, though the upstream advisory itself documents a minimal wire-level reproduction at a high level.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.
HTTP request smuggling in Netty's HTTP/1 decoder lets remote, unauthenticated attackers bypass front-end security controls and reach resources they should not access by sending requests with malformed Transfer-Encoding headers. Netty is a widely embedded Java networking library, so the practical reach spans Red Hat products built on it - AMQ Broker 7, AMQ Clients, Red Hat Build of Keycloak, Red Hat Build of Quarkus, Red Hat Build of Apache Camel (Spring Boot 4 and Quarkus 3), Red Hat Build of Debezium 3, Red Hat Build of Apicurio Registry 3, Red Hat Data Grid 8 and Red Hat Fuse 7 - as well as JBoss EAP 7/8 and Red Hat Single Sign-On 7 per the associated advisory tags. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with smuggling-style control bypass rather than full compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable on any exposed HTTP endpoint.
HTTP request smuggling in Netty's netty-codec-http component lets unauthenticated remote attackers bypass front-end security controls by sending a crafted HTTP/1.1 chunk-size token containing whitespace after the hexadecimal digits, which Netty parses differently from other HTTP intermediaries. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), meaning no authentication or user interaction is required, but integrity and availability impact is limited; meaningful exploitation generally depends on a multi-tier topology where a proxy, load balancer, or backend parses the chunk-size token inconsistently with Netty. Red Hat ships the affected library across a broad portfolio - including AMQ Broker 7, AMQ Clients, Quarkus, Keycloak and Red Hat Single Sign-On 7, JBoss EAP 7/8, Fuse 7, Data Grid 8, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Apicurio Registry 3 and Debezium 3 - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
This is a real but moderate-priority vulnerability whose severity depends almost entirely on deployment topology rather than the raw 6.5 CVSS score. Netty's HTTP decoder lets split or duplicated Transfer-Encoding header fields slip past its final-chunked validation, so an unauthenticated, remote attacker who can send a raw crafted request to a Netty listener that sits in an HTTP chain with a second HTTP parser (reverse proxy, load balancer, CDN, WAF, or upstream/downstream server) can desynchronize the two parsers and smuggle a request (CWE-444). Impact is confined to low confidentiality and integrity loss (C:L/I:L) with no availability impact, no authentication (PR:N) or user interaction (UI:N) is required, and no public exploit identified at time of analysis.
HTTP request smuggling in Netty's HTTP/1.1 decoder (HttpObjectDecoder and the HttpRequestDecoder built on it) lets remote, unauthenticated attackers send a chunk-size line containing an embedded bare carriage return - for example `0\rX` - because strict chunk-line validation is skipped whenever the size line carries no `;` chunk extension, causing a request-boundary desync when Netty shares a connection with a second HTTP intermediary that frames the message differently. The flaw reaches every application and Red Hat product that embeds Netty, including AMQ Broker 7, AMQ Clients, Quarkus, Camel 4 for Quarkus 3, Camel for Spring Boot 4, Keycloak / Red Hat Single Sign-On, JBoss EAP 7 and 8, Fuse 7, Data Grid 8, Apicurio Registry 3 and Debezium 3, while independent assessment keeps it at CVSS 6.5 with AC:H because a standalone Netty service with no disagreeing proxy in the chain yields little practical smuggling impact. The public report includes a reproducible PoC test harness, but there is no CISA KEV listing and no evidence of active exploitation.