Skip to main content

Uncontrolled Recursion

CVE-2022-41881

High
7.5/10

Summary

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, 5.0.0.Alpha1 and 5.0.0.Alpha2, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. There is no workaround, except using a custom "HaProxyMessageDecoder".

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-674 - Uncontrolled Recursion

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

Advisory Timeline

  • Published