HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr

Summary

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Timeline

1. Jan 29, 2020, 8:33 PM UTCCVE published
2. Oct 8, 2026, 9:11 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 8, 2026, 9:14 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• io.netty:netty-handlerMaven

  From 4.0.0 · fixed in 4.1.45

• org.jboss.netty:nettyMaven

  All versions

• io.netty:nettyMaven

  All versions

References 25