VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 26, 2019· Updated Jun 17, 2026

CVE-2019-16869

CVE-2019-16869

Description

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.netty:netty-allMaven
>= 4.0.0.Beta1, < 4.1.42.Final4.1.42.Final
org.jboss.netty:nettyMaven
<= 3.2.9.Final—
io.netty:nettyMaven
>= 3.3.0.Final, <= 4.0.0.Alpha8—

Affected products

11
  • Netty/Netty
    cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
    Range: <4.1.42
  • Red Hat/Jboss Enterprise Application Platform3 versions
    cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
  • Canonical/Ubuntu Linux
    cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • Debian/linux3 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • Netty/Nettydescription
  • ghsa-coords2 versions
    pkg:maven/io.netty/netty-allpkg:maven/org.jboss.netty/netty
    >= 4.0.0.Alpha1, < 4.1.42.Final+ 1 more
    • (no CPE)range: >= 4.0.0.Alpha1, < 4.1.42.Final
    • (no CPE)range: >= 0

Patches

Vulnerability mechanics

References

149

News mentions

0

No linked articles in our index yet.