CVE-2022-41915 - CVE House
Back to Database
Status published Medium CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. Starting...

Vulnerability Description

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-41915

Credits & Attribution

No credits recorded in the NVD database.

References

More from netty

View All →
CVE-2025-67735
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Medium 6.5
CVE-2025-59419
Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Medium 5.5
CVE-2025-58057
Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Medium 6.9
CVE-2025-58056
Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Low 2.9
CVE-2025-55163
Netty MadeYouReset HTTP/2 DDoS Vulnerability
High 8.2

Affected Vendor

Affected Software

netty
Vulnerable Versions:
4.1.86.Final, 4.1.83.Final

Timeline

Official Publish: December 13th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-436 CWE-113

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.