CVE-2019-20444: HTTP Request Smuggling in Netty
Summary
CVE-2019-20444: HTTP Request Smuggling in Netty. Affects io.netty:netty-codec-http versions < 4.1.44. Fixed in 4.1.44. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2019-20444 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular Java framework used for building high-performance network applications. It provides an event-driven architecture and a set of asynchronous I/O primitives. The 'io.netty:netty-codec-http' package is responsible for handling HTTP requests and responses. This vulnerability affects versions prior to 4.1.44. Netty allows an HTTP header that lacks a colon, which can be interpreted as a separate header with incorrect syntax or an 'invalid fold'.
Vulnerability Detail
The vulnerability in Netty allows an attacker to perform HTTP request smuggling attacks. By exploiting this issue, an attacker can manipulate the interpretation of HTTP requests and potentially bypass security controls. This can lead to various consequences, such as cache poisoning, session hijacking, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.44
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the secure version of Netty.
Conclusion
The HTTP Request Smuggling vulnerability in Netty can have severe consequences, including cache poisoning, session hijacking, and unauthorized access to sensitive information. It is crucial to upgrade to the secure version of Netty (4.1.44 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.netty:netty-codec-http →
FAQ
Netty is a Java framework used for building high-performance network applications. It provides an event-driven architecture and asynchronous I/O primitives.
HTTP request smuggling is a technique where an attacker manipulates the interpretation of HTTP requests to bypass security controls and perform unauthorized actions.
The consequences of this vulnerability include cache poisoning, session hijacking, and unauthorized access to sensitive information.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
To fix this vulnerability, you need to upgrade the 'io.netty:netty-codec-http' package in your Maven project to version 4.1.44 or later. Update the 'pom.xml' file with the new version.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec-http.
