CVE-2019-20444

CRITICAL

Netty < 4.1.44 - HTTP Request Smuggling via Malformed HTTP Header

Title source: llm
STIX 2.1

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

References (116)

Core 116
Core References
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0497
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0601
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0606
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0605
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0567
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0806
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0811
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0804
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0805
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html
Third Party Advisory vendor-advisory
https://usn.ubuntu.com/4532-1/
Third Party Advisory vendor-advisory
https://www.debian.org/security/2021/dsa-4885
Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/netty/netty/issues/9866

Scores

CVSS v3 9.1
EPSS 0.0868
EPSS Percentile 94.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-444
Status published
Products (12)
canonical/ubuntu_linux 18.04
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 33
io.netty/netty 0Maven
io.netty/netty-codec-http 0 - 4.1.44Maven
netty/netty < 4.1.44
org.jboss.netty/netty 0Maven
redhat/jboss_amq_clients 2
... and 2 more
Published Jan 29, 2020
Tracked Since Feb 18, 2026