~ / search / GHSA-ff2w-cq2g-wv5f

GHSA-ff2w-cq2g-wv5f

HTTP Request Smuggling in Netty

Source: GitHub Advisory Database (reviewed) High CVE-2020-7238

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-handler >= 4.1.43, < 4.1.45 4.1.45

Details

As written in the advisory (Markdown source, shown as plain text).

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

References

External links from the advisory. They lead to third-party sites.