~ / search / GHSA-cqqj-4p63-rrmm

GHSA-cqqj-4p63-rrmm

HTTP Request Smuggling in Netty

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-20444

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-codec-http < 4.1.44 4.1.44
Maven org.jboss.netty:netty < 4.0.0 no fix listed
Maven io.netty:netty < 4.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

References

External links from the advisory. They lead to third-party sites.