HTTP Request Smuggling in Netty

GHSA-p979-4mfw-53vg · CVE-2019-16869

Published Oct 11, 2019 · Modified May 21, 2024

Description

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

References

7.5 / 10

HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Packages

Maven/io.netty:netty-all

Fix 4.1.42.Final

Introduced 4.0.0.Alpha1

127 affected versions

4.0.0.Beta14.0.0.Beta24.0.0.Beta34.0.0.CR14.0.0.CR24.0.0.CR34.0.0.CR44.0.0.CR54.0.0.CR64.0.0.CR74.0.0.CR84.0.0.CR94.0.0.Final4.0.1.Final4.0.10.Final4.0.11.Final4.0.12.Final4.0.13.Final4.0.14.Beta14.0.14.Final +107 more

Maven/org.jboss.netty:netty

Introduced 0

39 affected versions

3.0.0.CR13.0.0.CR23.0.0.CR33.0.0.CR43.0.0.CR53.0.0.GA3.0.1.GA3.0.2.GA3.1.0.ALPHA13.1.0.ALPHA23.1.0.ALPHA33.1.0.ALPHA43.1.0.BETA13.1.0.BETA23.1.0.BETA33.1.0.CR13.1.0.GA3.1.1.GA3.1.2.GA3.1.3.GA +19 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes