[jira] [Created] (HADOOP-19788) Netty needs to be updated

["Edward Capriolo (Jira)" <ji...@apache.org>]

Edward Capriolo created HADOOP-19788:
----------------------------------------

             Summary: Netty needs to be updated
                 Key: HADOOP-19788
                 URL: https://issues.apache.org/jira/browse/HADOOP-19788
             Project: Hadoop Common
          Issue Type: Improvement
            Reporter: Edward Capriolo


{code:java}
//$ find . -name "*.java" | xargs grep HttpRequestEncoder
./hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/web/SimpleHttpProxyHandler.java:import io.netty.handler.codec.http.HttpRequestEncoder;
./hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/web/SimpleHttpProxyHandler.java:          p.addLast(new HttpRequestEncoder());
 {code}

[https://nvd.nist.gov/vuln/detail/CVE-2025-67735]


h3. Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Netty is constantly getting update, this seems like a legit reason as any.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org