Vulnerability in Netty
CVE-2019-16869
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.084 (94.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.084 · newest: 0.084 · change: 0.000
Affected products
- Netty
- Canonical Ubuntu Linux — versions 18.04
- Debian Linux — versions 8.0, 9.0, 10.0
- Red Hat Enterprise Linux — versions 6.0, 7.0, 8.0
- Red Hat Jboss Enterprise Application Platform — versions 7.2, 7.3, 7.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/netty/netty/issues/9571 (Exploit, Patch, Third Party Advisory, Issue Tracking)
- github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final (Patch, Third Party Advisory)
- lists.apache.org/thread.html/e39931d7cdd17241e69a0a09a89d99d7435bcc59afee8a9628… (mailing-list)
- lists.apache.org/thread.html/6e1e34c0d5635a987d595df9e532edac212307243bb1b49eea… (mailing-list)
- lists.apache.org/thread.html/2494a2ac7f66af6e4646a4937b17972a4ec7cd3c7333c66ffd… (mailing-list)
- lists.apache.org/thread.html/76540c8b0ed761bfa6c81fa28c13057f13a5448aed079d656f… (mailing-list)
- lists.apache.org/thread.html/9128111213b7b734ffc85db08d8f789b00a85a7f241b708e55… (mailing-list)
- lists.debian.org/debian-lts-announce/2019/09/msg00035.html (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/d3eb0dbea75ef5c400bd49dfa1901ad50be606cca3cb29e0d0… (mailing-list)
- lists.apache.org/thread.html/3e6d7aae1cca10257e3caf2d69b22f74c875f12a1314155af4… (mailing-list)
Frequently asked questions
- What is CVE-2019-16869?
- CVE-2019-16869 is a high-severity vulnerability in Netty, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.5/10. Published 2019-09-26.
- How severe is CVE-2019-16869?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-16869 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.