GHSA-5mcr-gq6c-3hq2 is a medium-severity (CVSS 6.2) CWE-378 vulnerability in io.netty:netty-codec-http. 1 public exploit reference exists, so weaponization risk is real. O3 Security confirms whether GHSA-5mcr-gq6c-3hq2 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Local Information Disclosure Vulnerability in Netty on Unix-Like systems
Real-World Exposure
io.netty:netty-codec-http☕org.jboss.netty:netty☕io.netty:nettyReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.
The CVSSv3.1 score of this vulnerability is calculated to be a 6.2/10
Vulnerability Details
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.
The method File.createTempFile on unix-like systems creates a random file, but, by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information.
This is the case in netty's AbstractDiskHttpData is vulnerable.
AbstractDiskHttpData is used as a part of the DefaultHttpDataFactory class which is used by HttpPostRequestDecoder / HttpPostMultiPartRequestDecoder.
You may be affected by this vulnerability your project contains the following code patterns:
channelPipeline.addLast(new HttpPostRequestDecoder(...));
channelPipeline.addLast(new HttpPostMultiPartRequestDecoder(...));
Patches
This has been patched in version 4.1.59.Final.
Workarounds
Specify your own java.io.tmpdir when you start the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
References
- CWE-378: Creation of Temporary File With Insecure Permissions
- CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Similar Vulnerabilities
Similar, but not the same.
- JUnit 4 - https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp
- Google Guava - https://github.com/google/guava/issues/4011
- Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945
- JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824
For more information
If you have any questions or comments about this advisory:
Original Report
Hi Netty Security Team,
I've been working on some security research leveraging custom CodeQL queries to detect local information disclosure vulnerabilities in java applications. This was the result from running this query against the netty project: https://lgtm.com/query/7723301787255288599/
Netty contains three local information disclosure vulnerabilities, so far as I can tell.
One is here, where the private key for the certificate is written to a temporary file.
One is here, where the certificate is written to a temporary file.
The final one is here, where the 'AbstractDiskHttpData' creates a temporary file if the getBaseDirectory() method returns null. I believe that 'AbstractDiskHttpData' is used as a part of the file upload support? If this is the case, any files uploaded would be similarly vulnerable.
All of these vulnerabilities exist because
File.createTempFile(String, String)will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. It is my understanding that when java creates a file, by default, and using this method, the permissions on that file utilize the umask. In a majority of cases, this means that the file that java creates has the permissions:-rw-r--r--, thus, any other local user on that system can read the contents of that file.Impacted OS:
- Any OS where the system temporary directory is shared between multiple users. This is not the case for MacOS or Windows.
Mitigation.
Moving to the
FilesAPI instead will fix this vulnerability. https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#createTempFile-java.nio.file.Path-java.lang.String-java.lang.String-java.nio.file.attribute.FileAttribute...-This API will explicitly set the posix file permissions to something safe, by default.
I recently disclosed a similar vulnerability in JUnit 4: https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp
If you're also curious, this vulnerability in Jetty was also mine, also involving temporary directories, but is not the same vulnerability as in this case. https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6
I would appreciate it if we could perform disclosure of this vulnerability leveraging the GitHub security advisories feature here. GitHub has a nice credit system that I appreciate, plus the disclosures, as you can see from the sampling above, end up looking very nice. https://github.com/netty/netty/security/advisories
This vulnerability disclosure follows Google's 90-day vulnerability disclosure policy (I'm not an employee of Google, I just like their policy). Full disclosure will occur either at the end of the 90-day deadline or whenever a patch is made widely available, whichever occurs first.
Cheers, Jonathan Leitschuh
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | io.netty:netty-codec-http | ≥ 4.0.0&&< 4.1.59.Final | 4.1.59.Final |
| ☕Maven | org.jboss.netty:netty | all versions | No fix |
| ☕Maven | io.netty:netty | all versions | No fix |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.netty:netty-codec-http. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update io.netty:netty-codec-http to 4.1.59.Final or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5mcr-gq6c-3hq2 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-5mcr-gq6c-3hq2 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-5mcr-gq6c-3hq2. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-5mcr-gq6c-3hq2 in your dependencies?
O3 detects GHSA-5mcr-gq6c-3hq2 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.