GHSA-p2v9-g2qv-p635Medium

HTTP Request Smuggling in Netty

Published
February 21, 2020
Last Modified
August 16, 2023

🔗 CVE IDs covered (1)

CVE-2019-20445 →

📋 Description

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

🎯 Affected products3

  • maven/io.netty:netty-handler:>= 4.0.0, < 4.1.45
  • maven/org.jboss.netty:netty:< 4.0.0
  • maven/io.netty:netty:< 4.0.0

🔗 References (57)