What’s Vulnerable › Vulnerabilities
CVE-2019-16869
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 8.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-09-26 · updated 2026-10-08
- Weakness: CWE-444
Description
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Affected products
- Canonical Ubuntu Linux: 18.04
- Debian Linux: 8.0, 9.0, 10.0
- netty: before 4.1.42 — fixed in 4.1.42
- Red Hat JBoss EAP: 7.2, 7.3, 7.4
How to fix
Upgrade to a fixed version: netty 4.1.42. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:3901
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/errata/RHSA-2020:0161
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0445
- https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final
- https://github.com/netty/netty/issues/9571
- https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-16869/5.0.0.Alpha1/exploit
- https://lists.apache.org/thread.html/0acadfb96176768caac79b404110df62d14d30aa9d53b6dbdb1407ac@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/19fed892608db1efe5a5ce14372137669ff639df0205323959af7de3@%3Cdev.olingo.apache.org%3E
Get alerted when CVE-2019-16869 or the next vulnerability affects your stack