-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jboss.resteasy:resteasy-netty4-cdi | maven | < 7.0.0.Alpha3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper state management in the HTTP decoder chain. The analysis shows that Netty's HttpObjectDecoder enters a BAD_MESSAGE state when processing malformed requests, but the surrounding RestEasyHttpRequestDecoder (which wraps Netty's decoder) does not adequately handle this state by either closing the connection or resetting the decoder. This matches the described vulnerability pattern where keep-alive connections remain in a broken state. The GitHub discussion explicitly references RestEasyHttpRequestDecoder's handling of decoder results and proposes fixes at this layer, confirming its role in the vulnerability.
JavaJavaOngoing coverage of React2Shell