Netty WebSocket Frame Handling Flaw Enables JBoss Server Memory Exhaustion

Red Hat addressed CVE-2014-0193, a low-severity denial-of-service flaw in Netty's WebSocket08FrameDecoder. An unauthenticated remote attacker could send a sequence of TextWebSocketFrame and ContinuationWebSocketFrame messages that caused uncontrolled memory aggregation, resulting in an OutOfMemoryException and potentially crashing or degrading an affected server. Netty fixed the issue in its 3.x and 4.x branches; Netty 3.2.x was not affected because it lacked the vulnerable WebSocket implementation.

The remediation was delivered to affected JBoss products through Red Hat security advisories, including RHSA-2014:1020 for JBoss EAP 6. Red Hat updated Netty to netty-3.6.9-1.Final_redhat_1.1.ep6.el6, incorporating upstream commit 4cc400ce2145a72820119b0eaab838d5d9263022, and verified the fix in EAP 6.3.0.ER10. Organizations operating affected JBoss deployments should apply the relevant Red Hat errata and verify that bundled Netty components are updated.