PT-2019-6163 · Netty+2 · Netty+2
Published
2019-12-10
·
Updated
2025-07-01
·
CVE-2019-20444
CVSS v2.0
9.4
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.1.44
Description
The issue is related to the HttpObjectDecoder.java component in Netty, which lacks a check for the presence of a colon in HTTP headers. This could lead to incorrect syntax interpretation or be seen as an "invalid fold." The exploitation of this issue might allow a remote attacker to access and compromise confidential data.
Recommendations
For versions prior to 4.1.44, update to version 4.1.44 or later to resolve the issue. As a temporary workaround, consider restricting access to the HttpObjectDecoder.java component to minimize the risk of exploitation.
Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Netty
Ubuntu