What is CVE-2024-40642?

CVE-2024-40642 is a high-severity vulnerability in Netty Netty-incubator-codec-ohttp, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2024-07-18.

How severe is CVE-2024-40642?

High severity. CVSS v3 base score is 8.1 out of 10.

Improper input validation in Netty Netty-incubator-codec-ohttp

CVE-2024-40642

The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly validate input values thus giving attackers almost complete control over the HTTP requests construct…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.007 (72.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Netty Netty-incubator-codec-ohttp — versions < 0.0.13.Final

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-q8f2-hxq5-cp4h (x_refsource_CONFIRM)
https://github.com/netty/netty-incubator-codec-ohttp/commit/b687a0cf6ea1030232ea204d73bce82f2698e571 (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-40642?: CVE-2024-40642 is a high-severity vulnerability in Netty Netty-incubator-codec-ohttp, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2024-07-18.
How severe is CVE-2024-40642?: High severity. CVSS v3 base score is 8.1 out of 10.