Description
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.45-1 | — |
| Debian 13 | netty | 1:4.1.45-1 | — |
| Debian 12 | netty | 1:4.1.45-1 | — |
| Debian 10 | netty | 1:4.1.33-1+deb10u2 | DSA-4885-1 |
| Debian 9 | netty | 1:4.1.7-2+deb9u2 | DLA-2364-1 |
| Debian 9 | netty-3.9 | 3.9.9.Final-1+deb9u1 | DLA-2365-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | netty | 1:3.2.6.Final-2+deb8u2 | DLA-2109-1 |
| Debian 8 | netty-3.9 | 3.9.0.Final-1+deb8u1 | DLA-2110-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1 | USN-4600-2 |
| Ubuntu 18.04 LTS | netty-3.9 | 3.9.9.Final-1+deb9u1build0.18.04.1 | USN-4532-1 |
| Ubuntu 16.04 LTS | netty-3.9 | 3.9.0.Final-1ubuntu0.1 | USN-4600-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 14.04 LTS | netty | 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-2.redhat_00009.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-4.b08_redhat_00003.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-7.SP3_redhat_00005.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.2-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jaegertracing-jaeger-client-java +2 | 0.34.1-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.28-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-8.Final_redhat_00009.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.el6eap | RHSA-2020:0605 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-23.SP12_redhat_00012.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-stax2-api | 4.2.0-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.10-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-thrift | 0.13.0-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-txw2 +8 | 2.3.3-4.b02_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.7-4.GA_redhat_00004.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.7-4.GA_redhat_00004.1.el7eap | RHSA-2020:0805 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +2 | 1.0.9-2.SP03_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.0.3-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.1.4-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat A Mq Clients 2 | nodejs-rhea | 1.0.16-1.el8 | RHSA-2020:0601 |
| Red Hat A Mq Clients 2 | python3-qpid-proton | 0.30.0-3.el8 | RHSA-2020:0601 |
| Red Hat A Mq Clients 2 | qpid-proton +9 | 0.30.0-2.el7 | RHSA-2020:0601 |
| Red Hat A Mq Clients 2 | rubygem-qpid_proton +1 | 0.30.0-1.el7 | RHSA-2020:0601 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 34.0.0-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty | all versions | — | GHSA-cqqj-4p63-rrmm |
| Maven | io.netty:netty-codec-http | < 4.1.44 | 4.1.44 | GHSA-cqqj-4p63-rrmm |
| Maven | org.jboss.netty:netty | all versions | — | GHSA-cqqj-4p63-rrmm |
Advisories 17
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0806 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0805 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0804 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0601 Red Hat Security Advisory: AMQ Clients 2.6.0 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0605 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4600-2 netty vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4532-1 netty-3.9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4600-1 netty-3.9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4885-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2365-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2364-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2110-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2109-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-2133 JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
References
- https://github.com/netty/netty/issues/9866
- https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final
- [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E
- [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E
- [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 mailing-list
- [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 mailing-list
- [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 mailing-list
- https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E
- [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E
- [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E
- RHSA-2020:0497 vendor-advisory
- [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities mailing-list
- [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, mailing-list
- [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update mailing-list
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update mailing-list
- [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- RHSA-2020:0601 vendor-advisory
- RHSA-2020:0606 vendor-advisory
- RHSA-2020:0605 vendor-advisory
- RHSA-2020:0567 vendor-advisory
- [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 mailing-list
- [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 mailing-list
- [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 mailing-list
- [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 mailing-list
- RHSA-2020:0806 vendor-advisory
- RHSA-2020:0811 vendor-advisory
- RHSA-2020:0804 vendor-advisory
- RHSA-2020:0805 vendor-advisory
- [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 mailing-list
- [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 mailing-list
- [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 mailing-list
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update mailing-list
- [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update mailing-list
- [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink mailing-list
- [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink mailing-list
- USN-4532-1 vendor-advisory
- FEDORA-2020-66b5f85ccc vendor-advisory
- [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list