GitHub Advisoryadvisory · Maven

GHSA-p979-4mfw-53vg HTTP Request Smuggling in Netty

HIGH Published 2019-10-11 Modified 2026-06-29 Official page ↗
Aliases
CVE-2019-16869
Ecosystem
Maven
Packages
io.netty:netty-all, org.jboss.netty:netty, io.netty:netty
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-444
Reviewed
2019-09-30

Affected packages

• Maven io.netty:netty-all: >= 4.0.0.Beta1, < 4.1.42.Final → fixed in 4.1.42.Final • Maven org.jboss.netty:netty: <= 3.2.9.Final (no fix yet) • Maven io.netty:netty: >= 3.3.0.Final, <= 4.0.0.Alpha8 (no fix yet)

Description

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Related

Alias · CVE (1)

  • CVE-2019-16869 Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References