netty/netty — Issue #141: hashdos security vulnerability in QueryStringDecoder and possibly other components
Author: trustin
Created: 2011-12-30 07:42:04+00:00
State: open
Labels: defect

http://mail-archives.apache.org/mod_mbox/www-announce/201112.mbox/%3C4EFB9800.5010106@apache.org%3E

We could limit the maximum number of decoded parameters in `QueryStringDecoder` and HTTP Header decoder. We also need to review all components that uses map-ish data structure and limit its max size if they can lead to a security hole.