View all vulnerabilities

CVE-2019-20444

HTTP Request Smuggling in Netty

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
9.1
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Versions
io.netty:netty-codec-http < 4.1.44
Severity
Ecosystem
Publish Date
February 21, 2020
Modified Date
July 2, 2025