cbcvebase.
CVE-2019-16869
published 2019-09-26

CVE-2019-16869: Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request…

PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
8.42%
94.4th percentile
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Affected

21 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debiandebian_linux
debiannetty< netty 1:4.1.33-2 (bookworm)netty 1:4.1.33-2 (bookworm)
debiannetty< netty 1:4.1.45-1 (bookworm)netty 1:4.1.45-1 (bookworm)
fedoraprojectfedora
nettynetty< 4.1.424.1.42
nettynetty
nettynetty>= 0 < 1:4.1.33-21:4.1.33-2
nettynetty>= 0 < 1:4.1.45-11:4.1.45-1
nettynetty>= 0 < 1:4.1.33-21:4.1.33-2
nettynetty>= 0 < 1:4.1.45-11:4.1.45-1
nettynetty>= 0 < 1:4.1.33-21:4.1.33-2
nettynetty>= 0 < 1:4.1.45-11:4.1.45-1
nettynetty>= 0 < 1:4.1.33-21:4.1.33-2
nettynetty>= 0 < 1:4.1.45-11:4.1.45-1
nettynetty>= 0 < 1:4.1.7-4ubuntu0.11:4.1.7-4ubuntu0.1
redhatjboss_enterprise_application_platform
redhatjboss_enterprise_application_platform
redhatjboss_enterprise_application_platform

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.