Executive brief
HTTP Request Smuggling in Netty
Affected products
- Maven io.netty:netty-codec-http
- Maven io.netty:netty
- Maven org.jboss.netty:netty
Junglewise Threat Intelligence
CVE-2019-20444: HTTP Request Smuggling in Netty
CVE-2019-20444 · Severity: low · CVSS 3.1 · Published 2020-02-21
Technologies: io.netty:netty-codec-http (Maven), io.netty:netty (Maven), org.jboss.netty:netty (Maven). Vendors: Maven.
Related threats
- Netty's HttpPostRequestDecoder can OOM
- Netty vulnerable to HTTP Response splitting from assigning header value iterator
- Local Information Disclosure Vulnerability in io.netty:netty-codec-http
- HTTP request smuggling in netty
- SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way