Description
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.33-2 | — |
| Debian 13 | netty | 1:4.1.33-2 | — |
| Debian 12 | netty | 1:4.1.33-2 | — |
| Debian 10 | netty | 1:4.1.33-1+deb10u1 | DSA-4597-1 |
| Debian 9 | netty | 1:4.1.7-2+deb9u1 | DSA-4597-1 |
| Debian 9 | netty-3.9 | 3.9.9.Final-1+deb9u1 | DLA-2365-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | netty | 1:3.2.6.Final-2+deb8u1 | DLA-1941-1 |
| Debian 8 | netty-3.9 | 3.9.0.Final-1+deb8u1 | DLA-2110-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | netty-3.9 | 3.9.9.Final-1+deb9u1build0.18.04.1 | USN-4532-1 |
| Ubuntu 16.04 LTS | netty-3.9 | 3.9.0.Final-1ubuntu0.1 | USN-4600-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 14.04 LTS | netty | 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.11-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-6.SP3_redhat_00004.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.14-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.9.10-1.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.1-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.9.10-2.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.27-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-7.Final_redhat_00007.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.42-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-21.SP12_redhat_00010.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.28-2.SP1_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-3.Final_redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.6-5.GA_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.18-2.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.6-5.GA_redhat_00001.1.el7eap | RHSA-2020:0160 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty | >= 3.3.0.Final, <= 4.0.0.Alpha8 | — | GHSA-p979-4mfw-53vg |
| Maven | io.netty:netty-all | >= 4.0.0.Beta1, < 4.1.42.Final | 4.1.42.Final | GHSA-p979-4mfw-53vg |
| Maven | org.jboss.netty:netty | <= 3.2.9.Final | — | GHSA-p979-4mfw-53vg |
Advisories 14
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4532-1 netty-3.9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4600-1 netty-3.9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4597-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2365-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1941-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2110-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
- WID-SEC-2022-2133 JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
References
- https://github.com/netty/netty/issues/9571
- https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final
- [zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 mailing-list
- [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 mailing-list
- [zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 mailing-list
- [zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty mailing-list
- [zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 mailing-list
- [debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update mailing-list
- [zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty mailing-list
- [zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 mailing-list
- [zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty mailing-list
- [zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 mailing-list
- [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 mailing-list
- [zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 mailing-list
- [zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 mailing-list
- [zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty mailing-list
- [zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty mailing-list
- [zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR mailing-list
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 mailing-list
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 mailing-list
- RHSA-2019:3892 vendor-advisory
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- RHSA-2019:3901 vendor-advisory
- [olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- [olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- [olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- [olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- [olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- [olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- [spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 mailing-list
- [olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty mailing-list
- DSA-4597 vendor-advisory
- 20200105 [SECURITY] [DSA 4597-1] netty security update mailing-list
- RHSA-2020:0164 vendor-advisory
- RHSA-2020:0159 vendor-advisory
- RHSA-2020:0160 vendor-advisory
- RHSA-2020:0161 vendor-advisory
- [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- RHSA-2020:0445 vendor-advisory
- [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities mailing-list
- [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, mailing-list
- [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update mailing-list
- [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 mailing-list