Unscored severity · published May 6, 2014
CVE-2014-0193
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial…
–
CVSS
4.3%
EPSS
No
On KEV
Description
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netty · Netty
3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; +26 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0193
Patch
http://netty.io/news/2014/04/30/release-day.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1019.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1020.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1021.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1351.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0675.html
More from Netty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.8
CVE-2026-56817
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
9.8
CVE-2026-42581
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization