GHSA-cqqj-4p63-rrmmCriticalCVSS 9.1

HTTP Request Smuggling in Netty

Published
February 21, 2020
Last Modified
July 2, 2025

🔗 CVE IDs covered (1)

CVE-2019-20444 →

📋 Description

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

🎯 Affected products3

  • maven/org.jboss.netty:netty:< 4.0.0
  • maven/io.netty:netty:< 4.0.0
  • maven/io.netty:netty-codec-http:< 4.1.44

🔗 References (120)