CVE-2022-41915 Information

Description

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final when calling DefaultHttpHeadesr.set with an iterator of values header value validation was not performed allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the DefaultHttpHeaders.set(CharSequence Iterator<?>) call into a remove() call and call add() in a loop over the iterator of values.

Reference

https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp