HTTP Request Smuggling in Netty

GHSA-p2v9-g2qv-p635 · CVE-2019-20445

Published Feb 21, 2020 · Modified Nov 8, 2023

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

References

Affected Packages

Maven/io.netty:netty

Introduced 0

71 affected versions

3.10.0.Final3.10.1.Final3.10.2.Final3.10.3.Final3.10.4.Final3.10.5.Final3.10.6.Final3.3.0.Final3.3.1.Final3.4.0.Alpha13.4.0.Alpha23.4.0.Beta13.4.0.Final3.4.1.Final3.4.2.Final3.4.3.Final3.4.4.Final3.4.5.Final3.4.6.Final3.5.0.Beta1 +51 more

Maven/io.netty:netty-handler

Fix 4.1.45

Introduced 4.0.0

118 affected versions

4.0.0.Final4.0.1.Final4.0.10.Final4.0.11.Final4.0.12.Final4.0.13.Final4.0.14.Beta14.0.14.Final4.0.15.Final4.0.16.Final4.0.17.Final4.0.18.Final4.0.19.Final4.0.2.Final4.0.20.Final4.0.21.Final4.0.22.Final4.0.23.Final4.0.24.Final4.0.25.Final +98 more

Maven/org.jboss.netty:netty

Introduced 0

39 affected versions

3.0.0.CR13.0.0.CR23.0.0.CR33.0.0.CR43.0.0.CR53.0.0.GA3.0.1.GA3.0.2.GA3.1.0.ALPHA13.1.0.ALPHA23.1.0.ALPHA33.1.0.ALPHA43.1.0.BETA13.1.0.BETA23.1.0.BETA33.1.0.CR13.1.0.GA3.1.1.GA3.1.2.GA3.1.3.GA +19 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes