{
  "cveId": "CVE-2022-41915",
  "url": "https://patchblox.com/security/cve/CVE-2022-41915",
  "summary": "CVE-2022-41915 is fixed in 2 products on 1 platform, first by libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm2, released December 12, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnetty-java: Netty project is an event-driven asynchronous network applicationframework",
  "description": "Netty project is an event-driven asynchronous network applicationframework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, whencalling \u0060DefaultHttpHeadesr.set\u0060 with an _iterator_ of values, header valuevalidation was not performed, allowing malicious header values in theiterator to perform HTTP Response Splitting. This issue has been patched inversion 4.1.86.Final. Integrators can work around the issue by changing the\u0060DefaultHttpHeaders.set(CharSequence, Iterator\u003C?\u003E)\u0060 call, into a \u0060remove()\u0060call, and call \u0060add()\u0060 in a loop over the iterator of values.",
  "published": "2022-12-12T23:15:00Z",
  "severity": "Medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00952,
  "epssPercentile": 0.61559,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:4.1.7-4ubuntu0.1\u002Besm2",
      "fix": "libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm2",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:4.1.45-1ubuntu0.1~esm1",
      "fix": "libnetty-java 1:4.1.45-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "fix": "libnetty-java 1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u1build0.22.04.1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.1.48-6",
      "fix": "libnetty-java 4.1.48-6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libnetty-java-4.1.48-6",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "4.1.48-6",
      "fix": "libnetty-java 4.1.48-6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libnetty-java-4.1.48-6",
      "released": "2026-01-16T01:42:24Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:4.1.48-6",
      "fix": "DEBIAN-CVE-2022-41915",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-41915",
      "released": "2022-12-13T07:15:13Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:4.1.48-6",
      "fix": "DEBIAN-CVE-2022-41915",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-41915",
      "released": "2022-12-13T07:15:13Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "Debian 14",
      "fixedVersion": "1:4.1.48-6",
      "fix": "DEBIAN-CVE-2022-41915",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-41915",
      "released": "2022-12-13T07:15:13Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}