Description
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.1.45-1 | — |
| Debian 13 | netty | 1:4.1.45-1 | — |
| Debian 12 | netty | 1:4.1.45-1 | — |
| Debian 10 | netty | 1:4.1.33-1+deb10u2 | DSA-4885-1 |
| Debian 9 | netty | 1:4.1.7-2+deb9u2 | DLA-2364-1 |
| Debian 9 | netty-3.9 | 3.9.9.Final-1+deb9u1 | DLA-2365-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | netty | 1:3.2.6.Final-2+deb8u2 | DLA-2109-1 |
| Debian 8 | netty-3.9 | 3.9.0.Final-1+deb8u1 | DLA-2110-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1 | USN-4600-2 |
| Ubuntu 18.04 LTS | netty-3.9 | 3.9.9.Final-1+deb9u1build0.18.04.1 | USN-4532-1 |
| Ubuntu 16.04 LTS | netty-3.9 | 3.9.0.Final-1ubuntu0.1 | USN-4600-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 14.04 LTS | netty | 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-2.redhat_00009.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-4.b08_redhat_00003.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-7.SP3_redhat_00005.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.2-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jaegertracing-jaeger-client-java +2 | 0.34.1-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.28-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-8.Final_redhat_00009.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.el6eap | RHSA-2020:0605 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-23.SP12_redhat_00012.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-stax2-api | 4.2.0-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.10-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-thrift | 0.13.0-1.redhat_00002.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-txw2 +8 | 2.3.3-4.b02_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.7-4.GA_redhat_00004.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.7-4.GA_redhat_00004.1.el7eap | RHSA-2020:0805 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +2 | 1.0.9-2.SP03_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.0.3-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.1.4-1.redhat_00001.1.el6eap | RHSA-2020:0806, RHSA-2020:0805, RHSA-2020:0804 |
| Red Hat A Mq Clients 2 | nodejs-rhea | 1.0.16-1.el8 | RHSA-2020:0601 |
| Red Hat A Mq Clients 2 | python3-qpid-proton | 0.30.0-3.el8 | RHSA-2020:0601 |
| Red Hat A Mq Clients 2 | qpid-proton +9 | 0.30.0-2.el7 | RHSA-2020:0601 |
| Red Hat A Mq Clients 2 | rubygem-qpid_proton +1 | 0.30.0-1.el7 | RHSA-2020:0601 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty | all versions | — | GHSA-p2v9-g2qv-p635 |
| Maven | io.netty:netty-handler | >= 4.0.0, < 4.1.45 | 4.1.45 | GHSA-p2v9-g2qv-p635 |
| Maven | org.jboss.netty:netty | all versions | — | GHSA-p2v9-g2qv-p635 |
Advisories 17
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0806 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0805 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0804 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0601 Red Hat Security Advisory: AMQ Clients 2.6.0 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0605 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4600-2 netty vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4532-1 netty-3.9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4600-1 netty-3.9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4885-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2365-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2364-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2110-1 netty-3.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2109-1 netty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-2133 JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
References
- https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final
- https://github.com/netty/netty/issues/9861
- [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 mailing-list
- [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 mailing-list
- [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E
- [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E
- [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E
- [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 mailing-list
- RHSA-2020:0497 vendor-advisory
- [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities mailing-list
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update mailing-list
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update mailing-list
- RHSA-2020:0601 vendor-advisory
- RHSA-2020:0606 vendor-advisory
- RHSA-2020:0605 vendor-advisory
- RHSA-2020:0567 vendor-advisory
- [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities mailing-list
- [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final mailing-list
- RHSA-2020:0806 vendor-advisory
- RHSA-2020:0811 vendor-advisory
- RHSA-2020:0804 vendor-advisory
- RHSA-2020:0805 vendor-advisory
- [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 mailing-list
- [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 mailing-list
- [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 mailing-list
- [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 mailing-list
- [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 mailing-list
- [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 mailing-list
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update mailing-list
- [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update mailing-list
- [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink mailing-list
- [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink mailing-list
- USN-4532-1 vendor-advisory
- FEDORA-2020-66b5f85ccc vendor-advisory
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 mailing-list
- [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 mailing-list
- [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 mailing-list
- DSA-4885 vendor-advisory
- [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx mailing-list
- [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 mailing-list