EXPOSURES › CVE-2019-20444
CVE-2019-20444
CRITICAL
DETAIL
SourceNVD · cve
Published2020-01-29
CVSS9.1
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-20444 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
DESCRIPTION
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
Canonical's Netty vulnerability was widely recognized as a critical flaw in a foundational Java library, leading to significant fallout despite eventual patching.
Severe technical flaw in a widely used library, though Canonical's response was generally adequate.
"HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'"
No substantive coverage; only a technical error in fetching the page.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.