HTTP Request Smuggling in Netty

GHSA-p979-4mfw-53vg · CVE-2019-16869

Published Oct 11, 2019 · Modified Jun 29, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

References

7.5 / 10

HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Packages

Maven/io.netty:netty

Introduced 3.3.0.Final

71 affected versions

3.10.0.Final3.10.1.Final3.10.2.Final3.10.3.Final3.10.4.Final3.10.5.Final3.10.6.Final3.3.0.Final3.3.1.Final3.4.0.Alpha13.4.0.Alpha23.4.0.Beta13.4.0.Final3.4.1.Final3.4.2.Final3.4.3.Final3.4.4.Final3.4.5.Final3.4.6.Final3.5.0.Beta1 +51 more

Maven/io.netty:netty-all

Fix 4.1.42.Final

Introduced 4.0.0.Beta1

127 affected versions

4.0.0.Beta14.0.0.Beta24.0.0.Beta34.0.0.CR14.0.0.CR24.0.0.CR34.0.0.CR44.0.0.CR54.0.0.CR64.0.0.CR74.0.0.CR84.0.0.CR94.0.0.Final4.0.1.Final4.0.10.Final4.0.11.Final4.0.12.Final4.0.13.Final4.0.14.Beta14.0.14.Final +107 more

Maven/org.jboss.netty:netty

Introduced 0

38 affected versions

3.0.0.CR13.0.0.CR23.0.0.CR33.0.0.CR43.0.0.CR53.0.0.GA3.0.1.GA3.0.2.GA3.1.0.ALPHA13.1.0.ALPHA23.1.0.ALPHA33.1.0.ALPHA43.1.0.BETA13.1.0.BETA23.1.0.BETA33.1.0.CR13.1.0.GA3.1.1.GA3.1.2.GA3.1.3.GA +18 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

HTTP Request Smuggling in Netty

Description

References

More Maven vulnerabilities

Start Securing