~ / search / GHSA-p2v9-g2qv-p635

GHSA-p2v9-g2qv-p635

HTTP Request Smuggling in Netty

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-20445

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-handler >= 4.0.0, < 4.1.45 4.1.45
Maven org.jboss.netty:netty < 4.0.0 no fix listed
Maven io.netty:netty < 4.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

References

External links from the advisory. They lead to third-party sites.