GitHub Advisoryadvisory · Maven

GHSA-p2v9-g2qv-p635 HTTP Request Smuggling in Netty

MEDIUM Published 2020-02-21 Modified 2021-08-25 Official page ↗
Aliases
CVE-2019-20445
Ecosystem
Maven
Packages
io.netty:netty-handler, org.jboss.netty:netty, io.netty:netty
Severity
Moderate
Weaknesses
CWE-444
Reviewed
2020-02-20

Affected packages

• Maven io.netty:netty-handler: >= 4.0.0, < 4.1.45 → fixed in 4.1.45 • Maven org.jboss.netty:netty: < 4.0.0 (no fix yet) • Maven io.netty:netty: < 4.0.0 (no fix yet)

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Related

Alias · CVE (1)

  • CVE-2019-20445 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References