← Vulnerability feed

Vulnerability record · CVE-2015-2156 · published 18 October 2017

CVE-2015-2156: Netty improper input validation vulnerability

Netty · Netty

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

7.5 CVSS 3.0 High EPSS 5.2% · top 7.8% CWE-20 · Improper input validation
7.5CVSS 3.0 base score, v2 4.3
5.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
24References
17 Jun 2026Last modified by NVD

Description

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html Third Party Advisory
http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/05/17/1 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/74704 Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1222923 Issue TrackingThird Party Advisory
https://github.com/netty/netty/pull/3754 Third Party Advisory
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.
https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apa
https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apa
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache
https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html Third Party Advisory
http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/05/17/1 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/74704 Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1222923 Issue TrackingThird Party Advisory
https://github.com/netty/netty/pull/3754 Third Party Advisory
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.
https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apa
https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apa
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache
https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass Third Party Advisory

Track CVE-2015-2156 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10.0CVE-2026-47691Netty insufficient verification of data authenticity vulnerabilityNetty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `…EPSS 0.36%10.0CVE-2026-45674Netty insufficient verification of data authenticity vulnerabilityNetty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's D…EPSS 0.36%9.8CVE-2026-42581Netty http request smuggling vulnerabilityNetty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…EPSS 0.68%9.8CVE-2014-3630Lightbend play framework xml external entity (xxe) vulnerabilityXML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attac…EPSS 2.9%9.1CVE-2026-75595Netty vulnerabilityNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHand…EPSS 0.46%9.1CVE-2026-56820Netty improper certificate validation vulnerabilityNetty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4…EPSS 0.31%9.1CVE-2026-42584Netty http request smuggling vulnerabilityNetty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound res…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2015-2156), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.