{"schema_version":"1.9.0","id":"CVE-2024-29025","published":"2024-03-25T20:09:35.156Z","modified":"2026-08-12T15:17:05.843020Z","aliases":["GHSA-5jpm-x58v-624v"],"related":["CGA-fg5g-gr66-r9f2","SUSE-SU-2024:1079-1","SUSE-SU-2024:1079-2","SUSE-SU-2024:2313-1","openSUSE-SU-2024:14101-1","openSUSE-SU-2024:14442-1"],"summary":"Netty HttpPostRequestDecoder can OOM","details":"Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netty/netty","events":[{"introduced":"0"},{"fixed":"3a3f9d13b129555802de5652667ca0af662f554e"},{"fixed":"0d0c6ed782d13d423586ad0c71737b2c7d02058c"}],"database_specific":{"cpe":"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.1.108"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["netty-4.1.107.Final","netty-4.1.106.Final","netty-4.1.105.Final","netty-4.1.104.Final","netty-4.1.103.Final","netty-4.1.102.Final","netty-4.1.101.Final","netty-4.1.100.Final","netty-4.1.99.Final","netty-4.1.98.Final","netty-4.1.97.Final","netty-4.1.96.Final","netty-4.1.95.Final","netty-4.1.94.Final","netty-4.1.93.Final","netty-4.1.92.Final","netty-4.1.91.Final","netty-4.1.90.Final","netty-4.1.89.Final","netty-4.1.88.Final","netty-4.1.87.Final","netty-4.1.86.Final","netty-4.1.85.Final","netty-4.1.84.Final","netty-4.1.83.Final","netty-4.1.82.Final","netty-4.1.81.Final","netty-4.1.80.Final","netty-4.1.79.Final","netty-4.1.78.Final","netty-4.1.77.Final","netty-4.1.76.Final","netty-4.1.75.Final","netty-4.1.74.Final","netty-4.1.73.Final","netty-4.1.72.Final","netty-4.1.71.Final","netty-4.1.70.Final","netty-4.1.69.Final","netty-4.1.68.Final","netty-4.1.67.Final","netty-4.1.66.Final","netty-4.1.65.Final","netty-4.1.64.Final","netty-4.1.63.Final","netty-4.1.62.Final","netty-4.1.61.Final","netty-4.1.60.Final","netty-4.1.59.Final","netty-4.1.58.Final","netty-4.1.57.Final","netty-4.1.56.Final","netty-4.1.55.Final","netty-4.1.54.Final","netty-4.1.53.Final","netty-4.1.52.Final","netty-4.1.51.Final","netty-4.1.50.Final","netty-4.1.49.Final","netty-4.1.48.Final","netty-4.1.47.Final","netty-4.1.46.Final","netty-4.1.45.Final","netty-4.1.44.Final","netty-4.1.43.Final","netty-4.1.42.Final","netty-4.1.41.Final","netty-4.1.40.Final","netty-4.1.39.Final","netty-4.1.38.Final","netty-4.1.37.Final","netty-4.1.36.Final","netty-4.1.35.Final","netty-4.1.34.Final","netty-4.1.33.Final","netty-4.1.32.Final","netty-4.1.31.Final","netty-4.1.30.Final","netty-4.1.29.Final","netty-4.1.28.Final","netty-4.1.27.Final","netty-4.1.26.Final","netty-4.1.25.Final","netty-4.1.24.Final","netty-4.1.23.Final","netty-4.1.22.Final","netty-4.1.21.Final","netty-4.1.20.Final","netty-4.1.19.Final","netty-4.1.18.Final","netty-4.1.17.Final","netty-4.1.16.Final","netty-4.1.15.Final","netty-4.1.14.Final","netty-4.1.13.Final","netty-4.1.12.Final","netty-4.1.11.Final","netty-4.1.10.Final","netty-4.1.9.Final","netty-4.1.8.Final","netty-4.1.7.Final","netty-4.1.6.Final","netty-4.1.5.Final","netty-4.1.4.Final","netty-4.1.3.Final","netty-4.1.2.Final","netty-4.1.1.Final","netty-4.1.0.Final","netty-4.1.0.CR7","netty-4.1.0.CR6","netty-4.1.0.CR5","netty-4.1.0.CR4","netty-4.1.0.CR3","netty-4.1.0.CR2","netty-4.1.0.CR1","netty-4.1.0.Beta8","netty-4.1.0.Beta7","netty-4.1.0.Beta6","netty-4.1.0.Beta5","netty-4.1.0.Beta4","netty-4.1.0.Beta3","netty-4.1.0.Beta2","netty-4.1.0.Beta1","netty-4.0.15.Final","netty-4.0.14.Final","netty-4.0.14.Beta1","netty-4.0.13.Final","netty-4.0.12.Final","netty-4.0.11.Final","netty-4.0.10.Final","netty-4.0.8.Final","netty-4.0.7.Final","netty-4.0.6.Final","netty-4.0.5.Final","netty-4.0.4.Final","netty-4.0.3.Final","netty-4.0.2.Final","netty-4.0.1.Final","netty-4.0.0.Final","netty-4.0.0.CR9","netty-4.0.0.CR8","netty-4.0.0.CR7","netty-4.0.0.CR5","netty-4.0.0.CR4","netty-4.0.0.CR3","netty-4.0.0.CR2","netty-4.0.0.CR1","netty-4.0.0.Beta3","netty-4.0.0.Beta2","netty-4.0.0.Beta1","netty-4.0.0.Alpha8","netty-4.0.0.Alpha7","netty-4.0.0.Alpha6","netty-4.0.0.Alpha5","netty-4.0.0.Alpha4","netty-4.0.0.Alpha3","netty-4.0.0.Alpha2","netty-4.0.0.Alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29025.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["122450151692868479589473767823875931257","227048753196673336934254777401338326645","209696816972309904902655121716152705161","224702976237987829096936032308163440637","190173220708387920660388984738807511406","23526410485975519760902325385165581378","316489529300248222116829278086921738204","131356784592826053957111036567673286854","93235360277304641272128447188056472645","130437890270660964901827108489983780223","61748962777394156101679532337821812537"],"threshold":0.9},"id":"CVE-2024-29025-076e9c2a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestDecoder.java"}},{"deprecated":false,"digest":{"function_hash":"153176450926276300821449915041775004490","length":375},"id":"CVE-2024-29025-2cc70c11","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostStandardRequestDecoder.java","function":"HttpPostStandardRequestDecoder"}},{"deprecated":false,"digest":{"function_hash":"101842439241297695255183183466134545323","length":956},"id":"CVE-2024-29025-391ca466","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java","function":"HttpPostMultipartRequestDecoder"}},{"deprecated":false,"digest":{"function_hash":"317974011032357045078584932794536885596","length":322},"id":"CVE-2024-29025-6ac169c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java","function":"addHttpData"}},{"deprecated":false,"digest":{"line_hashes":["302087266175243966286284289554136036631","67984430011339561163994336918411364267","142344119253237761547778643100807345053","61293617037668300536239235630410931725","310774028427191628963136495633022786067","164939520658134104177716003887351859587","327918073737922705344924808773279296753","120213564370457814353282956584653730909","97987352334673294017318609385229672538","273122612132945351495037125271802609973","122311086673641495798682965976834235244","257704116405846333104750391112259199903","40339713599769594037936529737800934205","171303010843381309160661682357971340715","42974547380927379796364378731783054557","7164295018175400805669997074593680235","298717858582435850628951446218024046781","311699150265268599236147082429119997882","211267350081913306120381997438079606413","121659064951626345877512808709112822850","243083782420996768014155976774271432885","197904898068342393100850570337570554135","310245013482033754249324587553653408660","18723042697714898494439215919497635335","4722653690041634060031335062240971334"],"threshold":0.9},"id":"CVE-2024-29025-9ab2620a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostStandardRequestDecoder.java"}},{"deprecated":false,"digest":{"line_hashes":["67635803767621412612510874556450160114","277580007022302710339584359893668730","212387710784104223044338585255640409023","88992490669128270505001002248218940422","171432378858561344490593714207544611366"],"threshold":0.9},"id":"CVE-2024-29025-a28dcc4f","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/multipart/HttpPostRequestDecoderTest.java"}},{"deprecated":false,"digest":{"function_hash":"317974011032357045078584932794536885596","length":322},"id":"CVE-2024-29025-c4f32f61","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostStandardRequestDecoder.java","function":"addHttpData"}},{"deprecated":false,"digest":{"function_hash":"293180439803495307356524328844434482141","length":715},"id":"CVE-2024-29025-d9b6a9cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostStandardRequestDecoder.java","function":"offer"}},{"deprecated":false,"digest":{"line_hashes":["311802145772508626849864381821553809099","249357302416559552693485998307036401140","284564412524958080416739708339405077365","195669099951573602906373602480758619847","99242396827301464878535972900329281380","303719150109711432191901896679378425936","242272867272514479060870355146414757008","332465510093836231097130466784073287388","311850963339514899627610561935338692597","327877378288282169246348196322023682646","311699150265268599236147082429119997882","211267350081913306120381997438079606413","121659064951626345877512808709112822850","243083782420996768014155976774271432885","197904898068342393100850570337570554135","310245013482033754249324587553653408660","18723042697714898494439215919497635335","4722653690041634060031335062240971334"],"threshold":0.9},"id":"CVE-2024-29025-e51c83b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java"}},{"deprecated":false,"digest":{"function_hash":"293180439803495307356524328844434482141","length":715},"id":"CVE-2024-29025-efc58ae9","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java","function":"offer"}}],"vanir_signatures_modified":"2026-08-12T15:17:05Z"}}],"references":[{"type":"WEB","url":"https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29025.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025"},{"type":"FIX","url":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29025.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}