epugh commented on code in PR #206: URL: https://github.com/apache/solr-site/pull/206#discussion_r3610635830
########## content/solr/vex/2026-07-18-cve-2026-41417.md: ########## @@ -0,0 +1,48 @@ +--- +cve: CVE-2026-41417 +category: + - solr/vex +versions: "9.2.0-9.10.x,10.0.x" +jars: + - netty-codec-http-4.2.6.Final.jar +analysis: + state: not_affected + justification: code_not_reachable +title: "Netty: HTTP request smuggling via setUri() CRLF-validation bypass" +--- +CVE-2026-41417 (CVSS 5.3) is a request-smuggling issue (CWE-93 / CWE-444) in Netty's HTTP/1.1 +codec. `DefaultHttpRequest` and `DefaultFullHttpRequest` reject CRLF and whitespace characters in +their constructors, but the `setUri()` method that lets a request's URI be rewritten after +construction has no equivalent validation, so an attacker who controls a value later passed to +`setUri()` can inject CRLF sequences and smuggle a second request. It affects Netty versions before +4.1.133.Final and 4.2.0.Alpha1–4.2.12.Final; it is fixed in 4.1.133.Final and 4.2.13.Final. + +Solr first started shipping Netty as a transitive dependency in **9.2.0** (SOLR-16532), when the Review Comment: fair enough... I'm still trying to get a sense of how much "explanation" to provide, and I will try and prune it back to more specifics. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
