{"id":"CVE-2024-29025","aliases":["GHSA-5jpm-x58v-624v"],"url":"https://o3.security/vulnerability/CVE-2024-29025","summary":"Netty HttpPostRequestDecoder can OOM","details":"### Summary\nThe `HttpPostRequestDecoder` can be tricked to accumulate data. I have spotted currently two attack vectors \n\n### Details\n1. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list.\n2. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits\n\n### PoC\n\nHere is a Netty branch that provides a fix + tests : https://github.com/vietj/netty/tree/post-request-decoder\n\n\nHere is a reproducer with Vert.x (which uses this decoder) https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3\n\n### Impact\nAny Netty based HTTP server that uses the `HttpPostRequestDecoder` to decode a form.","published":"2024-03-25T20:09:35.156Z","modified":"2026-08-12T15:17:05.843020Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.netty:netty-codec-http","fixedVersion":"4.1.108.Final"}],"fix":{"url":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","label":"netty/netty@0d0c6ed"},"references":[{"type":"WEB","url":"https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00015.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29025.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025"},{"type":"FIX","url":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c"},{"type":"PACKAGE","url":"https://github.com/netty/netty"},{"type":"WEB","url":"https://github.com/vietj/netty/tree/post-request-decoder"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:17:05.843020Z"}}