GHSA-ff2w-cq2g-wv5fHighCVSS 7.5

HTTP Request Smuggling in Netty

Published
February 21, 2020
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-7238 →

📋 Description

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

🎯 Affected products1

  • maven/io.netty:netty-handler:>= 4.1.43, <= 4.1.44

🔗 References (22)