HTTP Request Smuggling in Netty

GHSA-cqqj-4p63-rrmm · CVE-2019-20444

Published Feb 21, 2020 · Modified Jul 2, 2025

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

References

9.1 / 10

CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Packages

Maven/io.netty:netty

Introduced 0

71 affected versions

3.10.0.Final3.10.1.Final3.10.2.Final3.10.3.Final3.10.4.Final3.10.5.Final3.10.6.Final3.3.0.Final3.3.1.Final3.4.0.Alpha13.4.0.Alpha23.4.0.Beta13.4.0.Final3.4.1.Final3.4.2.Final3.4.3.Final3.4.4.Final3.4.5.Final3.4.6.Final3.5.0.Beta1 +51 more

Maven/io.netty:netty-codec-http

Fix 4.1.44

Introduced 0

137 affected versions

4.0.0.Alpha14.0.0.Alpha24.0.0.Alpha34.0.0.Alpha44.0.0.Alpha54.0.0.Alpha64.0.0.Alpha74.0.0.Alpha84.0.0.Beta14.0.0.Beta24.0.0.Beta34.0.0.CR14.0.0.CR24.0.0.CR34.0.0.CR44.0.0.CR54.0.0.CR64.0.0.CR74.0.0.CR84.0.0.CR9 +117 more

Maven/org.jboss.netty:netty

Introduced 0

39 affected versions

3.0.0.CR13.0.0.CR23.0.0.CR33.0.0.CR43.0.0.CR53.0.0.GA3.0.1.GA3.0.2.GA3.1.0.ALPHA13.1.0.ALPHA23.1.0.ALPHA33.1.0.ALPHA43.1.0.BETA13.1.0.BETA23.1.0.BETA33.1.0.CR13.1.0.GA3.1.1.GA3.1.2.GA3.1.3.GA +19 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes