Netty is an asynchronous network application framework. In versions before 4.1.136.Final and 4.2.16.Final, the HttpPostRequestEncoder component constructs multipart HTTP request bodies by concatenating user-supplied filenames and field names directly into Content-Disposition MIME headers without validating or neutralizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, this lack of sanitization enables an attacker who controls the filename to inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods neutralize CRLF characters before embedding the filename into the header. This vulnerability has been addressed in versions 4.1.136.Final and 4.2.16.Final.

An attacker able to control the filename in a multipart HTTP request can inject arbitrary MIME headers into the multipart body part. This can lead to HTTP header injection, potentially affecting the integrity of HTTP requests or responses processed by the application. The CVSS score of 6.5 (medium severity) reflects that the vulnerability requires network access with low complexity and privileges but can cause a high impact on integrity. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Upgrade Netty to version 4.1.136.Final or later, or 4.2.16.Final or later, where this vulnerability has been fixed by properly sanitizing CRLF characters in filenames and field names used in multipart HTTP request bodies. No other mitigations are indicated by the vendor advisory or source data.