HTTP Request Smuggling Vulnerability in Netty 4.1.43.Final
Summary
CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. Affects netty across 2 version ranges.
< 1:4.1.45-1
< d066f163d7476a4a332f95d4dc62af751378f536
Fixed in 1:4.1.45-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular asynchronous event-driven network application framework that simplifies network programming in Java. It is widely used for building high-performance network applications, including web servers and clients. The framework provides features such as support for various protocols, a powerful pipeline architecture, and ease of integration with other libraries. However, the version 4.1.43.Final of Netty has a critical vulnerability that affects its handling of HTTP requests, specifically related to Transfer-Encoding and Content-Length headers.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7238, arises from Netty's mishandling of whitespace in the Transfer-Encoding header when it is set to 'chunked', combined with a subsequent Content-Length header. This flaw allows attackers to exploit HTTP request smuggling techniques, potentially leading to unauthorized access, data manipulation, or other malicious activities. The issue is a result of an incomplete fix for a previous vulnerability (CVE-2019-16869), which highlights the importance of thorough testing and validation in security patches.
How To Fix
Minimum fixed version
1:4.1.45-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nettyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize HTTP headers and reject malformed requests. This can help mitigate the risk of exploitation until the upgrade is applied. However, this is not a complete solution and should not replace the necessary upgrade.
Conclusion
The CVE-2020-7238 vulnerability in Netty 4.1.43.Final poses significant risks due to improper handling of HTTP headers. Users are strongly advised to upgrade to version 4.1.45 or later to ensure their applications remain secure. Temporary workarounds can provide limited protection, but the upgrade is essential for long-term security.
See every vulnerability recorded for netty →
FAQ
CVE-2020-7238 is a vulnerability in Netty 4.1.43.Final that allows HTTP request smuggling due to improper handling of Transfer-Encoding and Content-Length headers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and other malicious activities, compromising the security of the affected application.
Netty versions prior to 4.1.45 are affected by this vulnerability. It is recommended to upgrade to version 4.1.45 or later.
Yes, implementing input validation to sanitize HTTP headers can help mitigate the risk until the upgrade is applied.
Related vulnerabilities
Recent vulnerabilities recorded for netty.
