Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2024-9622: Resteasy Netty4 may cause client timeouts
CVE-2024-9622 · published 2 years ago
Summary
The Resteasy Netty4 libraries (resteasy-netty4-cdi, resteasy-reactor-netty, and related components) can stop processing legitimate requests after receiving a specially crafted HTTP message. This can make clients wait until they time out, which can affect systems behind load balancers. Update to the latest version of the affected libraries or apply the vendor’s recommended fix to prevent the problem.
What to do
- Update canonical resteasy to version 3.0.6-3ubuntu0.1~esm1.
- Update canonical resteasy3.0 to version 3.0.26-1~18.04.1~esm1.
- Update canonical resteasy to version 3.6.2-2ubuntu0.20.04.1~esm1.
- Update canonical resteasy3.0 to version 3.0.26-1ubuntu0.1~esm1.
- Update canonical resteasy3.0 to version 3.0.26-3ubuntu0.1.
- Update canonical resteasy to version 3.6.2-2ubuntu0.22.04.1~esm1.
- Update canonical resteasy3.0 to version 3.0.26-6ubuntu0.24.04.1.
- Update canonical resteasy to version 3.6.2-2ubuntu0.24.04.1~esm1.
- Update jboss org.jboss.resteasy:resteasy-netty4-cdi to version 7.0.0.Alpha3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jboss | org.jboss.resteasy:resteasy-netty4-cdi | < 7.0.0.Alpha3 |
| Ubuntu:Pro:16.04:LTS | canonical | resteasy |
< 3.0.6-3ubuntu0.1~esm1 Fix: upgrade to 3.0.6-3ubuntu0.1~esm1
|
| Ubuntu:Pro:18.04:LTS | canonical | resteasy3.0 |
< 3.0.26-1~18.04.1~esm1 Fix: upgrade to 3.0.26-1~18.04.1~esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | resteasy |
< 3.6.2-2ubuntu0.20.04.1~esm1 Fix: upgrade to 3.6.2-2ubuntu0.20.04.1~esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | resteasy3.0 |
< 3.0.26-1ubuntu0.1~esm1 Fix: upgrade to 3.0.26-1ubuntu0.1~esm1
|
| Ubuntu:22.04:LTS | canonical | resteasy3.0 |
< 3.0.26-3ubuntu0.1 Fix: upgrade to 3.0.26-3ubuntu0.1
|
| Ubuntu:Pro:22.04:LTS | canonical | resteasy |
< 3.6.2-2ubuntu0.22.04.1~esm1 Fix: upgrade to 3.6.2-2ubuntu0.22.04.1~esm1
|
| Ubuntu:24.04:LTS | canonical | resteasy3.0 |
< 3.0.26-6ubuntu0.24.04.1 Fix: upgrade to 3.0.26-6ubuntu0.24.04.1
|
| Ubuntu:Pro:24.04:LTS | canonical | resteasy |
< 3.6.2-2ubuntu0.24.04.1~esm1 Fix: upgrade to 3.6.2-2ubuntu0.24.04.1~esm1
|
| Ubuntu:25.10 | canonical | resteasy | All versions |
| Ubuntu:25.10 | canonical | resteasy3.0 | All versions |
Original advisory text
Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4
A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.
References
- https://github.com/advisories/GHSA-5wpr-cj9p-959r
- https://access.redhat.com/security/cve/CVE-2024-9622 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2317179 Third Party Advisory
- https://github.com/orgs/resteasy/discussions/4351 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-9622 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-9622 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-9622 Third Party Advisory
- https://ubuntu.com/security/notices/USN-7351-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7630-1 Vendor Advisory
- https://github.com/resteasy/resteasy Third Party Advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9622.j... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published8 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5wpr-cj9p-959r · GHSA
CVE-2024-9622 · NVD
UBUNTU-CVE-2024-9622 · OSV
CVE-2024-9622 · OSV
Track software like this
Free during beta