Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2019-20444GHSA-CQQJ-4P63-RRMM

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.1.44
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  3. Record last updated

Affected versions

  • io.netty:netty-codec-httpMaven

    fixed in 4.1.44

  • org.jboss.netty:nettyMaven

    All versions

  • io.netty:nettyMaven

    All versions

References 25

GitHub · netty/netty

lists.apache.org