Bug 2553478

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

CRLF Injection vulnerability in the multipart message encoder of the Netty Java networking library (io.netty.handler.codec.http.multipart.HttpPostRequestEncoder). The flaw is caused by the direct concatenation of user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF sequences (\r\n) in the setFilename() method of DiskFileUpload, MemoryFileUpload, and MixedFileUpload, as well as in multiple code paths within HttpPostRequestEncoder.java (lines 519, 633, 674, 682, 686–688). When a specially crafted filename containing CRLF characters is processed, an attacker can inject arbitrary MIME headers into the multipart body part, enabling Content-Type spoofing, stored cross-site scripting (XSS), form field override, or manipulation of downstream middleware and storage layers. This can be exploited remotely with low privileges and without any user interaction, allowing attackers to compromise the confidentiality and integrity of applications or services using Netty's HTTP multipart encoding.