CVE-2019-20445 HTTP Request Smuggling in Netty
Netty allows HTTP request smuggling via duplicate Content-Length or Transfer-Encoding headers, enabling request desynchronization attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20445?
CVE-2019-20445 is a critical vulnerability in Canonical Ubuntu Linux, published on 29 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
Weakness: CWE-444
Which versions are affected by CVE-2019-20445?
6 open source packages ship an affected version, including io.netty:netty, io.netty:netty-handler and org.jboss.netty:netty. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty Maven | All versions | None |
io.netty:netty Maven | All versions | None |
io.netty:netty-handler Maven | From 4.0.0 | 4.1.45 |
io.netty:netty-handler Maven | From 4.0.0 | 4.1.45 |
org.jboss.netty:netty Maven | All versions | None |
org.jboss.netty:netty Maven | All versions | None |
Products include Apache Spark, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Netty Netty, Redhat Jboss Amq Clients and 1 more.
How do I fix CVE-2019-20445?
Upgrade to a fixed version.
Is CVE-2019-20445 being exploited?
There is no known exploitation of CVE-2019-20445 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as CLEANSTART-2026-JQ50151, CLSA-2026-1778028245, DEBIAN-CVE-2019-20445, GHSA-p2v9-g2qv-p635, MINI-cpx5-5gq5-8p59, MINI-j3xm-6pfh-4q28 and 1 more.