HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
|
Information
Published : 2020-01-29 13:15
Updated : 2021-09-14 05:45
NVD link : CVE-2019-20445
Mitre link : CVE-2019-20445
JSON object : View
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Products Affected
netty
- netty
redhat
- enterprise_linux
- jboss_enterprise_application_platform
- jboss_amq_clients
fedoraproject
- fedora
canonical
- ubuntu_linux
debian
- debian_linux
apache
- spark