~ / search / GHSA-p979-4mfw-53vg

GHSA-p979-4mfw-53vg

HTTP Request Smuggling in Netty

Source: GitHub Advisory Database (reviewed) High CVE-2019-16869

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-all >= 4.0.0.Beta1, < 4.1.42.Final 4.1.42.Final
Maven org.jboss.netty:netty <= 3.2.9.Final no fix listed
Maven io.netty:netty >= 3.3.0.Final, <= 4.0.0.Alpha8 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

References

External links from the advisory. They lead to third-party sites.