Back to Database
Status published
High
CVE-2020-7238
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding...
Vulnerability Description
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-7238
Credits & Attribution
No credits recorded in the NVD database.
References
- https://netty.io/news/
- https://github.com/jdordonezn/CVE-2020-72381/issues/1
- https://access.redhat.com/errata/RHSA-2020:0497
- https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
- https://access.redhat.com/errata/RHSA-2020:0601
- https://access.redhat.com/errata/RHSA-2020:0606
- https://access.redhat.com/errata/RHSA-2020:0605
- https://access.redhat.com/errata/RHSA-2020:0567
- https://access.redhat.com/errata/RHSA-2020:0806
- https://access.redhat.com/errata/RHSA-2020:0811
- https://access.redhat.com/errata/RHSA-2020:0804
- https://access.redhat.com/errata/RHSA-2020:0805
- https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/
- https://www.debian.org/security/2021/dsa-4885
- https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7%40%3Ccommits.cassandra.apache.org%3E
More from netty
View All →CVE-2025-67735
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Medium
6.5
CVE-2025-59419
Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Medium
5.5
CVE-2025-58057
Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Medium
6.9
CVE-2025-58056
Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Low
2.9
CVE-2025-55163
Netty MadeYouReset HTTP/2 DDoS Vulnerability
High
8.2
Affected Vendor
netty
View all reports →Affected Software
netty, fedora, debian linux, jboss enterprise application platform, jboss enterprise application platform text-only advisories, openshift application runtimes text-only advisories
Vulnerable Versions:
4.1.43, 33, 8.0, 9.0, 10.0, 7.2, 7.3, 7.4
Timeline
Official Publish:
January 27th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.