CVE-2019-16869

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which…

High7.5EPSS 8.6%

Published: 26 Sept 2019
Updated: 8 Oct 2026
Reserved: 25 Sept 2019
Assigned by: mitre

Description

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Scores

CVSS scores of CVE-2019-16869, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS (exploitation in 30 days): 8.6% · top 4.9% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

n/a
- affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Mavenio.netty:nettyGHSA-p979-4mfw-53vg (opens in a new tab)
Mavenio.netty:netty-allGHSA-p979-4mfw-53vg (opens in a new tab)
Mavenorg.jboss.netty:nettyGHSA-p979-4mfw-53vg (opens in a new tab)

References (146)

https://github.com/netty/netty/issues/9571 (opens in a new tab)x_refsource_MISCx_transferred
https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final (opens in a new tab)x_refsource_MISCx_transferred
[zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 (opens in a new tab)mailing-list
[zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 (opens in a new tab)mailing-list
[zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 (opens in a new tab)mailing-list
[zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 (opens in a new tab)mailing-list
[debian-lts-announce] 20190930 [SECURITY] [DLA 1941-1] netty security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 (opens in a new tab)mailing-list
[zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 (opens in a new tab)mailing-list
[zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 (opens in a new tab)mailing-list
[zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 (opens in a new tab)mailing-list
[zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 (opens in a new tab)mailing-list
[zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities (opens in a new tab)mailing-list
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-list
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-list
[tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR (opens in a new tab)mailing-list
[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 (opens in a new tab)mailing-list
[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 (opens in a new tab)mailing-list
RHSA-2019:3892 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities (opens in a new tab)mailing-list
RHSA-2019:3901 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
[olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
[spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-list
[olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-list
DSA-4597 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
20200105 [SECURITY] [DSA 4597-1] netty security update (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
RHSA-2020:0164 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2020:0159 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2020:0160 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2020:0161 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
[druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-list
RHSA-2020:0445 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
[cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities (opens in a new tab)mailing-list
[hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, (opens in a new tab)mailing-list
[hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-list
[hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 (opens in a new tab)mailing-list
[debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-list
[flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-list
USN-4532-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
[camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) (opens in a new tab)mailing-list
[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-list
[rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 (opens in a new tab)mailing-list
[rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 (opens in a new tab)mailing-list
[rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 (opens in a new tab)mailing-list
[pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-list
[pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-list
[pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-list
[cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty (opens in a new tab)mailing-list
[cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty (opens in a new tab)mailing-list
[cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 (opens in a new tab)mailing-list
[cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 (opens in a new tab)mailing-list
https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-16869/5.0.0.Alpha1/exploit (opens in a new tab)
[zookeeper-dev] 20190930 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty with CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-dev] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20190930 [jira] [Updated] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20190930 [jira] [Created] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - netty-3.10.6.Final.jar: CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20190930 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-dev] 20191001 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20191001 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-dev] 20191002 Re: [VOTE] Apache ZooKeeper release 3.5.6 candidate 2 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-commits] 20191003 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-commits] 20191003 [zookeeper] branch master updated: ZOOKEEPER-3563: Update Netty to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-commits] 20191003 [zookeeper] branch branch-3.5.6 updated: ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20191003 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20191008 [jira] [Resolved] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[zookeeper-issues] 20191008 [jira] [Commented] (ZOOKEEPER-3563) dependency check failing on 3.4 and 3.5 branches - CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[tinkerpop-commits] 20191022 [tinkerpop] branch tp34 updated: Bump to Netty 4.1.42 fixes CVE-2019-16869 - CTR (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15418) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 for Cassendra 2.2.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191206 [jira] [Updated] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191206 [jira] [Created] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191206 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191206 [jira] [Assigned] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191206 [jira] [Resolved] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191209 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191219 [jira] [Updated] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191219 [jira] [Created] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191219 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191220 [jira] [Resolved] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191220 [jira] [Issue Comment Deleted] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191220 [jira] [Comment Edited] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191220 [jira] [Commented] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[spark-issues] 20191220 [jira] [Reopened] (SPARK-30308) Update Netty and Netty-all to address CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[olingo-dev] 20191227 [jira] [Commented] (OLINGO-1414) Dependency check fails on 4.7.0 : CVE-2019-16869 on Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[rocketmq-dev] 20201224 [GitHub] [rocketmq] crazywen opened a new pull request #2517: fix CVE-2019-16869, CVE-2018-8020 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[rocketmq-dev] 20201224 [GitHub] [rocketmq] coveralls commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[rocketmq-dev] 20201224 [GitHub] [rocketmq] codecov-io commented on pull request #2517: fix CVE-2019-16869, CVE-2018-8020 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15417) CVE-2019-16869(Netty is vulnerable to HTTP Request Smuggling) of severity 7.5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-16869](https://trackcve.app/badge/CVE-2019-16869.svg)](https://trackcve.app/cve/CVE-2019-16869)

Record last updated 8 Oct 2026, 21:14 UTC.