Vulnerabilities in pkg:maven/io.netty/netty

Q: What is CVE-2019-16869?

CVE-2019-16869 is a security vulnerability in Netty all involving HTTP Request Smuggling in Netty under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling').

Q: Which Netty all versions are affected?

Affected versions include releases prior to 4.1.42.Final across affected packages: io.netty:netty-all, org.jboss.netty:netty, io.netty:netty.

Q: What version fixes CVE-2019-16869?

Upgrading to 4.1.42.Final (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is netty-all affected?

Yes, io.netty:netty-all is affected in releases prior to 4.1.42.Final. Upgrade your dependency to 4.1.42.Final or later.

Q: Is netty affected?

Yes, org.jboss.netty:netty is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.

Q: What is the CVSS score of CVE-2019-16869?

CVE-2019-16869 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Q: What CWE is associated with CVE-2019-16869?

CVE-2019-16869 is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.).

Q: How can I check Maven dependencies for CVE-2019-16869?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.netty'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-p979-4mfw-53vg

Advisory Summary

CVE-2019-16869 is a HIGH (CVSS 7.5) http request smuggling vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')) affecting Netty all libraries in the Maven ecosystem. The issue involves http request smuggling in netty. Remediation is available by upgrading affected packages to version 4.1.42.Final.

11 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:maven/io.netty/netty

11 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/io.netty/netty. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-p979-4mfw-53vg	CVE-2019-16869	HIGH	HTTP Request Smuggling in Netty
GHSA-cqqj-4p63-rrmm	CVE-2019-20444	CRITICAL	HTTP Request Smuggling in Netty
GHSA-7vpq-g998-qpv7	CVE-2014-0193	MODERATE	Netty denial of service vulnerability
GHSA-wx5j-54mm-rqqq	CVE-2021-43797	MODERATE	HTTP request smuggling in netty
GHSA-5mcr-gq6c-3hq2	CVE-2021-21290	MODERATE	Local Information Disclosure Vulnerability in Netty on Unix-Like systems
GHSA-f256-j965-7f32	CVE-2021-21409	MODERATE	Possible request smuggling in HTTP/2 due missing validation of content-length
GHSA-grg4-wf29-r9vv	CVE-2021-37136	HIGH	Bzip2Decoder doesn't allow setting size restrictions for decompressed data
GHSA-9vjp-v76f-g363	CVE-2021-37137	HIGH	SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
GHSA-xfv3-rrfm-f2rv	CVE-2015-2156	HIGH	Information Exposure in Netty
GHSA-wm47-8v5p-wjpj	CVE-2021-21295	MODERATE	Possible request smuggling in HTTP/2 due missing validation
GHSA-p2v9-g2qv-p635	CVE-2019-20445	MODERATE	HTTP Request Smuggling in Netty

CVE-2019-16869 at a Glance

CVE Identifier CVE-2019-16869

GHSA Identifier GHSA-p979-4mfw-53vg

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Product Netty all

Package Ecosystem Maven

Published Date 2019-10-11

Last Updated 2026-06-29

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

How to Fix CVE-2019-16869

To remediate this vulnerability, upgrade all affected Netty all dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

io.netty:netty-all fixed: 4.1.42.Final

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty-all</artifactId>
    <version>4.1.42.Final</version>
</dependency>

org.jboss.netty:netty fixed: Latest secure release

<dependency>
    <groupId>org.jboss.netty</groupId>
    <artifactId>netty</artifactId>
    <version>Latest secure release</version>
</dependency>

io.netty:netty fixed: Latest secure release

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty</artifactId>
    <version>Latest secure release</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=io.netty

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2019-16869, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=io.netty

Analyze the terminal output to locate any version of Netty all in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.1.42.Final), your application is affected.

Note: The mvn dependency:tree -Dincludes=io.netty command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), where the product acts as an intermediary http agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed http requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. In Netty all, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

CVE-2019-16869 Affected Netty all Versions

3 component(s)

Fixed Versions:

4.1.42.Final

Product / Package	Ecosystem	Affected Versions	Fixed Version
io.netty:netty-all maven/io.netty/netty-all	Maven	≥ 4.0.0.Beta1 < 4.1.42.Final	4.1.42.Final
org.jboss.netty:netty maven/org.jboss.netty/netty	Maven	≤ 3.2.9.Final
io.netty:netty maven/io.netty/netty	Maven	≥ 3.3.0.Final ≤ 4.0.0.Alpha8

References

usn.ubuntu.com/4532-1 WEB

https://usn.ubuntu.com/4532-1

NVD — CVE-2019-16869 NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-16869

Netty all Source Repository REPOSITORY

https://github.com/netty/netty/issues/9571

lists.apache.org/thread.html/raaac04... WEB

https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E

lists.apache.org/thread.html/r959474... WEB

https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/r90030b... WEB

https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/r86befa... WEB

https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4@%3Ccommon-commits.hadoop.apache.org%3E

lists.apache.org/thread.html/r8402d6... WEB

https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/r832724... WEB

https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E

lists.apache.org/thread.html/r831e05... WEB

https://lists.apache.org/thread.html/r831e0548fad736a98140d0b3b7dc575af0c50faea0b266434ba813cc@%3Cdev.rocketmq.apache.org%3E

lists.apache.org/thread.html/r7790b9... WEB

https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E

lists.apache.org/thread.html/r73c400... WEB

https://lists.apache.org/thread.html/r73c400ab66d79821dec9e3472f0e2c048d528672bdb0f8bf44d7cb1f@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/r4d3f1d... WEB

https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/r3225f7... WEB

https://lists.apache.org/thread.html/r3225f7dfe6b8a37e800ecb8e31abd7ac6c4312dbd3223dd8139c37bb@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/r131e57... WEB

https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/r0c3d49... WEB

https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/r0aa8b2... WEB

https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E

lists.apache.org/thread.html/f9bc3e5... WEB

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E

lists.apache.org/thread.html/f6c5ebf... WEB

https://lists.apache.org/thread.html/f6c5ebfb018787c764f000362d59e4b231c0a36b6253aa866de8c64e@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/ee6faea... WEB

https://lists.apache.org/thread.html/ee6faea9e542c0b90afd70297a9daa203e20d41aa2ac7fca6703662f@%3Cissues.spark.apache.org%3E

lists.apache.org/thread.html/e39931d... WEB

https://lists.apache.org/thread.html/e39931d7cdd17241e69a0a09a89d99d7435bcc59afee8a9628d67769@%3Cdev.zookeeper.apache.org%3E

lists.apache.org/thread.html/e192fe8... WEB

https://lists.apache.org/thread.html/e192fe8797c192679759ffa6b15e4d0806546945a41d8ebfbc6ee3ac@%3Ccommits.tinkerpop.apache.org%3E

lists.apache.org/thread.html/d7d5305... WEB

https://lists.apache.org/thread.html/d7d530599dc7813056c712213e367b68cdf56fb5c9b73f864870bc4c@%3Cdev.olingo.apache.org%3E

Netty all Security Information SECURITY

https://www.debian.org/security/2020/dsa-4597

seclists.org/bugtraq/2020/jan/6 WEB

https://seclists.org/bugtraq/2020/Jan/6

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2019/09/msg00035.html

lists.apache.org/thread.html/rf5b2df... WEB

https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E

lists.apache.org/thread.html/rf2bf8e... WEB

https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/re78eae... WEB

https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/re45ee9... WEB

https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E

lists.apache.org/thread.html/re0b78a... WEB

https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/rdd5d24... WEB

https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9@%3Ccommon-commits.hadoop.apache.org%3E

lists.apache.org/thread.html/rdb6912... WEB

https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E

lists.apache.org/thread.html/rd0e44e... WEB

https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E

lists.apache.org/thread.html/rcddf72... WEB

https://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833@%3Cdev.rocketmq.apache.org%3E

lists.apache.org/thread.html/rcb2c59... WEB

https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6@%3Ccommon-commits.hadoop.apache.org%3E

lists.apache.org/thread.html/rc8d554... WEB

https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/rc7eb56... WEB

https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/rb3361f... WEB

https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836@%3Ccommon-issues.hadoop.apache.org%3E

lists.apache.org/thread.html/rb25b42... WEB

https://lists.apache.org/thread.html/rb25b42f666d2cac5e6e6b3f771faf60d1f1aa58073dcdd8db14edf8a@%3Cdev.rocketmq.apache.org%3E

lists.apache.org/thread.html/6063699... WEB

https://lists.apache.org/thread.html/6063699b87b501ecca8dd3b0e82251bfc85f29363a9b46ac5ace80cf@%3Cdev.olingo.apache.org%3E

lists.apache.org/thread.html/519eb0f... WEB

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E

lists.apache.org/thread.html/51923a9... WEB

https://lists.apache.org/thread.html/51923a9ba513b2e816e02a9d1fd8aa6f12e3e4e99bbd9dc884bccbbe@%3Cissues.spark.apache.org%3E

lists.apache.org/thread.html/3e6d7aa... WEB

https://lists.apache.org/thread.html/3e6d7aae1cca10257e3caf2d69b22f74c875f12a1314155af422569d@%3Cdev.zookeeper.apache.org%3E

lists.apache.org/thread.html/380f6d2... WEB

https://lists.apache.org/thread.html/380f6d2730603a2cd6b0a8bea9bcb21a86c199147e77e448c5f7390b@%3Ccommits.zookeeper.apache.org%3E

lists.apache.org/thread.html/37ed432... WEB

https://lists.apache.org/thread.html/37ed432b8eb35d8bd757f53783ec3e334bd51f514534432bea7f1c3d@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/35961d1... WEB

https://lists.apache.org/thread.html/35961d1ae00849974353a932b4fef12ebce074541552eceefa04f1fd@%3Cdev.olingo.apache.org%3E

lists.apache.org/thread.html/2e1cf53... WEB

https://lists.apache.org/thread.html/2e1cf538b502713c2c42ffa46d81f4688edb5676eb55bd9fc4b4fed7@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/2494a2a... WEB

https://lists.apache.org/thread.html/2494a2ac7f66af6e4646a4937b17972a4ec7cd3c7333c66ffd6c639d@%3Cdev.zookeeper.apache.org%3E

lists.apache.org/thread.html/19fed89... WEB

https://lists.apache.org/thread.html/19fed892608db1efe5a5ce14372137669ff639df0205323959af7de3@%3Cdev.olingo.apache.org%3E

lists.apache.org/thread.html/0acadfb... WEB

https://lists.apache.org/thread.html/0acadfb96176768caac79b404110df62d14d30aa9d53b6dbdb1407ac@%3Cissues.spark.apache.org%3E

Netty all Source Repository REPOSITORY

https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final

Netty all Source Repository REPOSITORY

https://github.com/netty/netty

access.redhat.com/errata/rhsa-2020:04... WEB

https://access.redhat.com/errata/RHSA-2020:0445

access.redhat.com/errata/rhsa-2020:01... WEB

https://access.redhat.com/errata/RHSA-2020:0164

access.redhat.com/errata/rhsa-2020:01... WEB

https://access.redhat.com/errata/RHSA-2020:0161

access.redhat.com/errata/rhsa-2020:01... WEB

https://access.redhat.com/errata/RHSA-2020:0160

access.redhat.com/errata/rhsa-2020:01... WEB

https://access.redhat.com/errata/RHSA-2020:0159

access.redhat.com/errata/rhsa-2019:39... WEB

https://access.redhat.com/errata/RHSA-2019:3901

access.redhat.com/errata/rhsa-2019:38... WEB

https://access.redhat.com/errata/RHSA-2019:3892

lists.apache.org/thread.html/d3eb0db... WEB

https://lists.apache.org/thread.html/d3eb0dbea75ef5c400bd49dfa1901ad50be606cca3cb29e0d01b6a54@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/d14f721... WEB

https://lists.apache.org/thread.html/d14f721e0099b914daebe29bca199fde85d8354253be9d6d3d46507a@%3Ccommits.cassandra.apache.org%3E

lists.apache.org/thread.html/cf5aa08... WEB

https://lists.apache.org/thread.html/cf5aa087632ead838f8ac3a42e9837684e7afe6e0fcb7704e0c73bc0@%3Ccommits.zookeeper.apache.org%3E

lists.apache.org/thread.html/cbf6e6a... WEB

https://lists.apache.org/thread.html/cbf6e6a04cb37e9320ad20e437df63beeab1755fc0761918ed5c5a6e@%3Ccommits.zookeeper.apache.org%3E

lists.apache.org/thread.html/bdf7a5e... WEB

https://lists.apache.org/thread.html/bdf7a5e597346a75d2d884ca48c767525e35137ad59d8f10b8fc943c@%3Cdev.zookeeper.apache.org%3E

lists.apache.org/thread.html/b3ddeeb... WEB

https://lists.apache.org/thread.html/b3ddeebbfaf8a288d7de8ab2611cf2609ab76b9809f0633248546b7c@%3Cissues.spark.apache.org%3E

lists.apache.org/thread.html/b3dda63... WEB

https://lists.apache.org/thread.html/b3dda6399a0ea2b647624b899fd330fca81834e41b13e3e11e1002d8@%3Cdev.olingo.apache.org%3E

lists.apache.org/thread.html/b2cd517... WEB

https://lists.apache.org/thread.html/b2cd51795f938632c6f60a4c59d9e587fbacd7f7d0e0a3684850a30f@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/b264fa5... WEB

https://lists.apache.org/thread.html/b264fa5801e87698e9f43f2b5585fbc5ebdc26c6f4aad861b258fb69@%3Cdev.olingo.apache.org%3E

lists.apache.org/thread.html/b0656d3... WEB

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E

lists.apache.org/thread.html/af6e9c2... WEB

https://lists.apache.org/thread.html/af6e9c2d716868606523857a4cd7a5ee506e6d1710f5fb0d567ec030@%3Cdev.olingo.apache.org%3E

lists.apache.org/thread.html/a0f77c7... WEB

https://lists.apache.org/thread.html/a0f77c73af32cbe4ff0968bfcbbe80ae6361f3dccdd46f3177547266@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/9317fd0... WEB

https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E

lists.apache.org/thread.html/9128111... WEB

https://lists.apache.org/thread.html/9128111213b7b734ffc85db08d8f789b00a85a7f241b708e55debbd0@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/860acce... WEB

https://lists.apache.org/thread.html/860acce024d79837e963a51a42bab2cef8e8d017aad2b455ecd1dcf0@%3Cissues.spark.apache.org%3E

lists.apache.org/thread.html/799eb85... WEB

https://lists.apache.org/thread.html/799eb85d67cbddc1851a3e63a07b55e95b2f44f1685225d38570ce89@%3Cissues.spark.apache.org%3E

lists.apache.org/thread.html/76540c8... WEB

https://lists.apache.org/thread.html/76540c8b0ed761bfa6c81fa28c13057f13a5448aed079d656f6a3c79@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/6e1e34c... WEB

https://lists.apache.org/thread.html/6e1e34c0d5635a987d595df9e532edac212307243bb1b49eead6d55b@%3Cissues.zookeeper.apache.org%3E

lists.apache.org/thread.html/681493a... WEB

https://lists.apache.org/thread.html/681493a2f9b63f5b468f741d88d1aa51b2cfcf7a1c5b74ea8c4343fb@%3Cissues.spark.apache.org%3E

lists.apache.org/thread.html/64b10f4... WEB

https://lists.apache.org/thread.html/64b10f49c68333aaecf00348c5670fe182e49fd60d45c4a3ab241f8b@%3Cissues.spark.apache.org%3E

Frequently Asked Questions

What is CVE-2019-16869?

CVE-2019-16869 is a security vulnerability in Netty all involving HTTP Request Smuggling in Netty under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling').

Which Netty all versions are affected?

Affected versions include releases prior to 4.1.42.Final across affected packages: io.netty:netty-all, org.jboss.netty:netty, io.netty:netty.

What version fixes CVE-2019-16869?

Upgrading to 4.1.42.Final (or the latest patched release for your respective branch) resolves the vulnerability.

Is netty-all affected?

Yes, io.netty:netty-all is affected in releases prior to 4.1.42.Final. Upgrade your dependency to 4.1.42.Final or later.

Is netty affected?

Yes, org.jboss.netty:netty is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.

What is the CVSS score of CVE-2019-16869?

CVE-2019-16869 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

What CWE is associated with CVE-2019-16869?

CVE-2019-16869 is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.).

How can I check Maven dependencies for CVE-2019-16869?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.netty'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p979-4mfw-53vg",
  "modified" : "2026-06-29T15:34:52Z",
  "published" : "2019-10-11T18:41:23Z",
  "aliases" : [ "CVE-2019-16869" ],
  "summary" : "HTTP Request Smuggling in Netty",
  "details" : "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.netty:netty-all"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0.Beta1"
      }, {
        "fixed" : "4.1.42.Final"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.jboss.netty:netty"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "3.2.9.Final"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.netty:netty"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.3.0.Final"
      }, {
        "last_affected" : "4.0.0.Alpha8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2019-16869"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/netty/netty/issues/9571"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4@%3Ccommon-commits.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r831e0548fad736a98140d0b3b7dc575af0c50faea0b266434ba813cc@%3Cdev.rocketmq.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r73c400ab66d79821dec9e3472f0e2c048d528672bdb0f8bf44d7cb1f@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r3225f7dfe6b8a37e800ecb8e31abd7ac6c4312dbd3223dd8139c37bb@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/f6c5ebfb018787c764f000362d59e4b231c0a36b6253aa866de8c64e@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/ee6faea9e542c0b90afd70297a9daa203e20d41aa2ac7fca6703662f@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/e39931d7cdd17241e69a0a09a89d99d7435bcc59afee8a9628d67769@%3Cdev.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/e192fe8797c192679759ffa6b15e4d0806546945a41d8ebfbc6ee3ac@%3Ccommits.tinkerpop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/d7d530599dc7813056c712213e367b68cdf56fb5c9b73f864870bc4c@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2020/dsa-4597"
  }, {
    "type" : "WEB",
    "url" : "https://usn.ubuntu.com/4532-1"
  }, {
    "type" : "WEB",
    "url" : "https://seclists.org/bugtraq/2020/Jan/6"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2019/09/msg00035.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9@%3Ccommon-commits.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833@%3Cdev.rocketmq.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6@%3Ccommon-commits.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836@%3Ccommon-issues.hadoop.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rb25b42f666d2cac5e6e6b3f771faf60d1f1aa58073dcdd8db14edf8a@%3Cdev.rocketmq.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/6063699b87b501ecca8dd3b0e82251bfc85f29363a9b46ac5ace80cf@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/51923a9ba513b2e816e02a9d1fd8aa6f12e3e4e99bbd9dc884bccbbe@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/3e6d7aae1cca10257e3caf2d69b22f74c875f12a1314155af422569d@%3Cdev.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/380f6d2730603a2cd6b0a8bea9bcb21a86c199147e77e448c5f7390b@%3Ccommits.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/37ed432b8eb35d8bd757f53783ec3e334bd51f514534432bea7f1c3d@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/35961d1ae00849974353a932b4fef12ebce074541552eceefa04f1fd@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/2e1cf538b502713c2c42ffa46d81f4688edb5676eb55bd9fc4b4fed7@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/2494a2ac7f66af6e4646a4937b17972a4ec7cd3c7333c66ffd6c639d@%3Cdev.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/19fed892608db1efe5a5ce14372137669ff639df0205323959af7de3@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/0acadfb96176768caac79b404110df62d14d30aa9d53b6dbdb1407ac@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/netty/netty"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0445"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0164"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0161"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0160"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2020:0159"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3901"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2019:3892"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/d3eb0dbea75ef5c400bd49dfa1901ad50be606cca3cb29e0d01b6a54@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/d14f721e0099b914daebe29bca199fde85d8354253be9d6d3d46507a@%3Ccommits.cassandra.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/cf5aa087632ead838f8ac3a42e9837684e7afe6e0fcb7704e0c73bc0@%3Ccommits.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/cbf6e6a04cb37e9320ad20e437df63beeab1755fc0761918ed5c5a6e@%3Ccommits.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/bdf7a5e597346a75d2d884ca48c767525e35137ad59d8f10b8fc943c@%3Cdev.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b3ddeebbfaf8a288d7de8ab2611cf2609ab76b9809f0633248546b7c@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b3dda6399a0ea2b647624b899fd330fca81834e41b13e3e11e1002d8@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b2cd51795f938632c6f60a4c59d9e587fbacd7f7d0e0a3684850a30f@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b264fa5801e87698e9f43f2b5585fbc5ebdc26c6f4aad861b258fb69@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/af6e9c2d716868606523857a4cd7a5ee506e6d1710f5fb0d567ec030@%3Cdev.olingo.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/a0f77c73af32cbe4ff0968bfcbbe80ae6361f3dccdd46f3177547266@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/9128111213b7b734ffc85db08d8f789b00a85a7f241b708e55debbd0@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/860acce024d79837e963a51a42bab2cef8e8d017aad2b455ecd1dcf0@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/799eb85d67cbddc1851a3e63a07b55e95b2f44f1685225d38570ce89@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/76540c8b0ed761bfa6c81fa28c13057f13a5448aed079d656f6a3c79@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/6e1e34c0d5635a987d595df9e532edac212307243bb1b49eead6d55b@%3Cissues.zookeeper.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/681493a2f9b63f5b468f741d88d1aa51b2cfcf7a1c5b74ea8c4343fb@%3Cissues.spark.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/64b10f49c68333aaecf00348c5670fe182e49fd60d45c4a3ab241f8b@%3Cissues.spark.apache.org%3E"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-444" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2019-09-30T14:47:35Z",
    "nvd_published_at" : "2019-09-26T16:15:00Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Advisory Metadata

Source ID: GHSA-p979-4mfw-53vg
Schema Version: 1.4.0
Published: 2019-10-11 18:41
Last Modified: 2026-06-29 15:34
Database Record File: advisories/github-reviewed/2019/10/GHSA-p979-4mfw-53vg/GHSA-p979-4mfw-53vg.json