CVE catalog

CVE-2022-41915

netty affected and fixed versions

[CVE catalog]

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.95% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securitynetty1:4.1.48-10+deb13u1Fixed[CVE-2022-41915]
Debiantrixienetty1:4.1.48-10+deb13u1Fixed[CVE-2022-41915]
Debiantrixienetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debiansidnetty1:4.1.48-16Fixed[CVE-2022-41915]
Debiansidnetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Ubuntupronetty1:4.1.45-1ubuntu0.1~esm1Fixed[UBUNTU-CVE-2022-41915]
Debianforkynetty1:4.1.48-16Fixed[CVE-2022-41915]
Debianforkynetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debianbookworm-securitynetty1:4.1.48-7+deb12u2Fixed[CVE-2022-41915]
Debianbookwormnetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debianbookwormnetty1:4.1.48-7+deb12u2Fixed[CVE-2022-41915]
Ubuntu22.04netty1:4.1.48-4+deb11u1build0.22.04.1Fixed[UBUNTU-CVE-2022-41915]

Showing 12 fix observations. All 21 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormnetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debianbookwormnetty1:4.1.48-7+deb12u2Fixed[CVE-2022-41915]
Debianbookworm-securitynetty1:4.1.48-7+deb12u2Fixed[CVE-2022-41915]
Debianforkynetty1:4.1.48-16Fixed[CVE-2022-41915]
Debianforkynetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debiansidnetty1:4.1.48-16Fixed[CVE-2022-41915]
Debiansidnetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debiantrixienetty1:4.1.48-10+deb13u1Fixed[CVE-2022-41915]
Debiantrixienetty1:4.1.48-6FixedDistribution-reported fixed boundary[CVE-2022-41915]
Debiantrixie-securitynetty1:4.1.48-10+deb13u1Fixed[CVE-2022-41915]
Ubuntu16.04netty-3.93.9.0.Final-1Affected[UBUNTU-CVE-2022-41915]
Ubuntu16.04netty-3.93.9.0.Final-1ubuntu0.1Affected[UBUNTU-CVE-2022-41915]
Ubuntu18.04netty-3.93.9.9.Final-1Affected[UBUNTU-CVE-2022-41915]
Ubuntu18.04netty-3.93.9.9.Final-1+deb9u1build0.18.04.1Affected[UBUNTU-CVE-2022-41915]
Ubuntu22.04netty1:4.1.48-4Affected[UBUNTU-CVE-2022-41915]
Ubuntu22.04netty1:4.1.48-4+deb11u1build0.22.04.1Fixed[UBUNTU-CVE-2022-41915]
Ubuntupronetty1:4.1.33-1Affected[UBUNTU-CVE-2022-41915]
Ubuntupronetty1:4.1.33-2Affected[UBUNTU-CVE-2022-41915]
Ubuntupronetty1:4.1.33-3Affected[UBUNTU-CVE-2022-41915]
Ubuntupronetty1:4.1.45-1Affected[UBUNTU-CVE-2022-41915]
Ubuntupronetty1:4.1.45-1ubuntu0.1~esm1Fixed[UBUNTU-CVE-2022-41915]
Original provider fields
{
  "package_releases": [
    {
      "name": "netty",
      "status": "fixed",
      "release": "sid",
      "version": "1:4.1.48-16"
    },
    {
      "name": "netty",
      "status": "fixed",
      "release": "forky",
      "version": "1:4.1.48-16"
    },
    {
      "name": "netty",
      "status": "fixed",
      "release": "trixie",
      "version": "1:4.1.48-10+deb13u1"
    },
    {
      "name": "netty",
      "status": "fixed",
      "release": "trixie-security",
      "version": "1:4.1.48-10+deb13u1"
    },
    {
      "name": "netty",
      "status": "fixed",
      "release": "bookworm",
      "version": "1:4.1.48-7+deb12u2"
    },
    {
      "name": "netty",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1:4.1.48-7+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1027180,
      "name": "netty",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1:4.1.48-6"
    },
    {
      "bug": 1027180,
      "name": "netty",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1:4.1.48-6"
    },
    {
      "bug": 1027180,
      "name": "netty",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1:4.1.48-6"
    },
    {
      "bug": 1027180,
      "name": "netty",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1:4.1.48-6"
    }
  ],
  "distribution_packages": [
    {
      "name": "netty",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:4.1.45-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1:4.1.33-1",
        "1:4.1.33-2",
        "1:4.1.33-3",
        "1:4.1.45-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-41915",
      "fixed_version": "1:4.1.45-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-41915",
      "provider_updated_at": "2026-02-04T02:50:20.708392Z"
    },
    {
      "name": "netty-3.9",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "3.9.0.Final-1",
        "3.9.0.Final-1ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-41915",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-41915",
      "provider_updated_at": "2026-02-04T02:50:20.708392Z"
    },
    {
      "name": "netty-3.9",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "3.9.9.Final-1",
        "3.9.9.Final-1+deb9u1build0.18.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-41915",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-41915",
      "provider_updated_at": "2026-02-04T02:50:20.708392Z"
    },
    {
      "name": "netty",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:4.1.48-4+deb11u1build0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1:4.1.48-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-41915",
      "fixed_version": "1:4.1.48-4+deb11u1build0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-41915",
      "provider_updated_at": "2026-02-04T02:50:20.708392Z"
    }
  ]
}

[Debian bug #1027180]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libnetty-java]Unknown

    Source package: [netty]

    Details (4)

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Fixed · Fixed: 1:4.1.48-6

      dsa · netty · debian · bookworm

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Fixed · Fixed: 1:4.1.48-6

      dsa · netty · debian · bookworm

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:4.1.48-6

      dsa · netty · debian · bookworm

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1:4.1.48-6

      dsa · netty · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]