CVE-2024-9622

Name: CVE-2024-9622
Creator: NVD / NIST
Published: 2024-10-08T17:15:57.79+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.3/10EPSS 0.65%

Last modified Jun 17, 2026

CVE-2024-9622 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. EPSS estimates a 0.65% chance of exploitation in the next 30 days.

Description

A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Probability

0.65%

46.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-444

References

Timeline

Published: Oct 8, 2024
Last Modified: Jun 17, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2024-9622?

How severe is CVE-2024-9622?

CVE-2024-9622 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.65% probability of exploitation in the next 30 days.

How do I fix CVE-2024-9622?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-9622?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST