CVE-2019-20445: HTTP Request Smuggling in Netty
Summary
CVE-2019-20445: HTTP Request Smuggling in Netty. Affects io.netty:netty-handler versions >= 4.0.0, < 4.1.45. Fixed in 4.1.45. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2019-20445 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular open-source networking framework for building high-performance, scalable applications. It provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high-performance protocol servers and clients. Netty is widely used in various applications and is known for its robustness and performance. However, a vulnerability has been discovered in Netty that allows for HTTP request smuggling.
Vulnerability Detail
The vulnerability, identified as CVE-2019-20445, exists in the HttpObjectDecoder.java class in Netty versions before 4.1.44. It allows an attacker to exploit a flaw in the handling of Content-Length headers. Specifically, the vulnerability allows for the presence of multiple Content-Length headers or a Content-Length header accompanied by a Transfer-Encoding header. This can lead to various security issues, including request smuggling attacks, where an attacker can bypass security measures and manipulate the HTTP request/response flow. The impact of this vulnerability can range from information disclosure to remote code execution, depending on the specific application and its configuration.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.45
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Netty is not immediately feasible, a temporary workaround can be implemented. This involves manually modifying the affected code to address the vulnerability. The specific workaround will depend on the application and how Netty is used within it. It is recommended to consult the official Netty documentation and seek guidance from the Netty community or security experts for assistance in implementing an appropriate workaround.
Conclusion
The HTTP request smuggling vulnerability in Netty can have serious security implications for applications using affected versions. It is crucial to promptly address this vulnerability by upgrading to the latest secure version of Netty or implementing an appropriate workaround. Regularly monitoring for vulnerabilities in open-source dependencies, such as using Vulert, can help ensure the security of your software.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
Netty is an open-source networking framework for building high-performance, scalable applications. It provides tools and components for developing network protocols and servers/clients.
HTTP request smuggling is a technique that allows an attacker to manipulate the HTTP request/response flow, bypass security measures, and potentially exploit vulnerabilities in the application or server.
The impact of this vulnerability can vary depending on the specific application and its configuration. It can range from information disclosure to remote code execution, potentially leading to unauthorized access, data breaches, or other security compromises.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
For further support or assistance in fixing this vulnerability, you can reach out to info@devnack.com. The Devnack team can provide guidance, resources, and expertise to help remediate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
