Critical severity · published Jan 29, 2020
CVE-2019-20445
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header
9.1
CVSS
13.8%
EPSS
No
On KEV
Description
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
8.0; 9.0; 10.0 · source: NVD
FE
Fedora · Fedoraproject
33 · source: NVD
JA
Jboss Amq Clients · Redhat
2 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
7.2; 7.3 · source: NVD
NE
Netty · Netty
before 4.1.44 · source: NVD
SP
Spark · Apache
2.4.7; 2.4.8 · source: NVD
UL
Ubuntu Linux · Canonical
18.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20445
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0497
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0567
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0601
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0605
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0606
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0804
More from Spark
8.8
CVE-2022-33891
Apache Spark shell command injection vulnerability via Spark UI
9.9
CVE-2023-22946
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges
9.8
CVE-2020-9480
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret
9.8
CVE-2018-17190
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts
8.8
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerability