CVE-2024-29025 Overview
CVE-2024-29025 affects Netty, an asynchronous event-driven network application framework used to build high-performance protocol servers and clients. The vulnerability resides in the HttpPostRequestDecoder component, which fails to enforce limits on the number of fields parsed from a multipart form. An attacker can submit a chunked HTTP POST request containing many small fields, causing the decoder to accumulate data in the bodyListHttpData list without bound. The flaw is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling] and resolved in Netty 4.1.108.Final.
Critical Impact
Remote unauthenticated attackers can exhaust memory on Netty-based HTTP servers by sending crafted chunked POST requests, leading to denial of service.
Affected Products
- Netty versions prior to 4.1.108.Final
- Debian Linux 10 (Buster) packages bundling vulnerable Netty
- Applications and frameworks embedding the vulnerable HttpPostRequestDecoder
Discovery Timeline
- 2024-03-25 - CVE-2024-29025 published to the National Vulnerability Database
- 2025-09-19 - Last updated in NVD database
Technical Details for CVE-2024-29025
Vulnerability Analysis
The defect is a resource exhaustion condition in Netty's multipart form decoder. The HttpPostRequestDecoder parses HTTP POST bodies and stores parsed fields in an in-memory list called bodyListHttpData. While Netty allows individual items to spill to disk when configured, the decoder enforces no upper bound on the number of fields contained within a single request. An attacker who streams a chunked POST request packed with thousands of small form fields forces unbounded growth of this list.
A second amplification vector exists inside the undecodedChunk buffer. The decoder accumulates raw bytes into undecodedChunk until it can decode a complete field. A single field with no terminating delimiter can grow this buffer without limit, consuming heap memory until the JVM throws an OutOfMemoryError.
The issue impacts availability rather than confidentiality or integrity. Applications using HttpPostRequestDecoder to process untrusted input — including reverse proxies, REST APIs, and microservices built on Netty, Vert.x, or Reactor Netty — are exposed.
Root Cause
The root cause is missing input validation on two parser state variables. Neither the field count in bodyListHttpData nor the size of undecodedChunk is checked against a configurable maximum. The decoder trusts that callers terminate the stream, which is not a safe assumption for HTTP services exposed to the public internet.
Attack Vector
Exploitation requires network access to an HTTP endpoint that uses HttpPostRequestDecoder to parse multipart/form-data or application/x-www-form-urlencoded bodies. The attacker sends a chunked POST request with either a high count of small fields or a single field with no boundary delimiter. No authentication is required. See the Gist Vulnerability Report for the proof of concept describing the parser behavior.
Detection Methods for CVE-2024-29025
Indicators of Compromise
- Sustained high heap utilization or repeated OutOfMemoryError events in Netty-based server logs
- Inbound chunked POST requests with abnormally large field counts or missing multipart boundary terminators
- Long-lived HTTP connections originating from a small set of source addresses correlated with memory spikes
Detection Strategies
- Inventory deployed Java applications and identify Netty dependencies below 4.1.108.Final using software composition analysis tooling
- Inspect HTTP traffic at the proxy or WAF layer for chunked requests exceeding a defined field count or body size threshold
- Correlate JVM garbage collection pauses and heap exhaustion events with concurrent inbound HTTP request patterns
Monitoring Recommendations
- Enable JVM heap and GC metrics export to your observability stack and alert on sustained heap saturation
- Log and rate-limit clients sending oversized or malformed multipart requests at the load balancer
- Track Netty version inventory continuously through dependency scanning in CI/CD pipelines
How to Mitigate CVE-2024-29025
Immediate Actions Required
- Upgrade Netty to version 4.1.108.Final or later in all affected applications and rebuild downstream artifacts
- Apply Debian security updates for the netty package referenced in the Debian LTS Security Announcement
- Audit transitive dependencies in frameworks such as Vert.x, Reactor Netty, Spring WebFlux, and gRPC for bundled Netty versions
Patch Information
The fix is committed in the Netty repository under commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c and described in the GitHub Security Advisory GHSA-5jpm-x58v-624v. The patch enforces configurable limits on the number of accumulated form fields and on undecodedChunk growth.
Workarounds
- Place a reverse proxy in front of Netty-based services and enforce maximum request body size and field count limits
- Reject chunked POST requests at the edge for endpoints that do not legitimately require multipart uploads
- Configure application-level filters to terminate connections that exceed expected field counts before invoking HttpPostRequestDecoder
# Example: Maven dependency override to enforce patched Netty version
mvn dependency:tree | grep netty
# Update pom.xml to pin Netty
# <dependency>
# <groupId>io.netty</groupId>
# <artifactId>netty-codec-http</artifactId>
# <version>4.1.108.Final</version>
# </dependency>
mvn clean install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
