GitHub Advisoryadvisory · Maven

GHSA-ff2w-cq2g-wv5f HTTP Request Smuggling in Netty

HIGH Published 2020-02-21 Modified 2021-08-19 Official page ↗
Aliases
CVE-2020-7238
Ecosystem
Maven
Packages
io.netty:netty-handler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-444
Reviewed
2020-02-20

Affected packages

• Maven io.netty:netty-handler: >= 4.1.43, < 4.1.45 → fixed in 4.1.45

Description

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Related

Alias · CVE (1)

  • CVE-2020-7238 Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References