VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 29, 2020· Updated Aug 5, 2024

CVE-2019-20445

CVE-2019-20445

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Netty before 4.1.44 incorrectly accepts multiple Content-Length headers or a Content-Length header with Transfer-Encoding, enabling HTTP request smuggling.

Vulnerability

Description

The vulnerability resides in HttpObjectDecoder.java of the Netty library, affecting versions prior to 4.1.44. The decoder fails to enforce RFC7230 requirements that prohibit multiple Content-Length headers in a single HTTP message, and also fails to reject a Content-Length header when a Transfer-Encoding: chunked header is present [1][2]. This violates HTTP/1.1 protocol semantics, where such combinations are considered ambiguous and potentially malicious.

Exploitation and

Attack Surface

An attacker can craft an HTTP request with conflicting headers—for example, two Content-Length headers with different values, or a Content-Length header alongside Transfer-Encoding: chunked. When a vulnerable Netty-based server or proxy processes such a request, it may interpret the message body differently than a downstream server, leading to HTTP request smuggling [2]. This attack requires the ability to send specially crafted HTTP requests to the target application. No authentication is required beyond network access, making it exploitable by external attackers.

Impact

Successful exploitation can allow an attacker to desynchronize the interpretation of HTTP message boundaries between a front-end proxy and back-end server. This can lead to cache poisoning, session hijacking, and bypassing security controls. The vulnerability has a CVSS v3 base score of 8.6 (High) due to its network attack vector, low complexity, and potential for severe integrity and confidentiality impacts [1].

Mitigation

The issue was fixed in Netty version 4.1.44, released in December 2019 [2]. Users should upgrade to version 4.1.44 or later. Red Hat has issued advisories RHSA-2020:0601 and RHSA-2020:0805 to address the vulnerability in impacted Red Hat products [3][4]. No workarounds are documented; applying the patched version is the recommended action.

References
  1. NVD - CVE-2019-20445
  2. Verify we do not receive multiple content-length headers or a content-length and transfer-encoding: chunked header when using HTTP/1.1 by normanmaurer · Pull Request #9865 · netty/netty
  3. https://access.redhat.com/errata/RHSA-2020:0601
  4. https://access.redhat.com/errata/RHSA-2020:0805

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.netty:netty-handlerMaven
>= 4.0.0, < 4.1.454.1.45
org.jboss.netty:nettyMaven
>= 0—
io.netty:nettyMaven
>= 0—

Affected products

9

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

95

News mentions

0

No linked articles in our index yet.