HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header…

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Timeline

Scores

EPSS (exploitation in 30 days)

8.9% · top 4.7% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Weakness

• n/a
• CWE-444 (opens in a new tab)All about CWE-444 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenio.netty:nettyGHSA-cqqj-4p63-rrmm (opens in a new tab)
• Mavenio.netty:netty-codec-httpGHSA-cqqj-4p63-rrmm (opens in a new tab)
• Mavenorg.jboss.netty:nettyGHSA-cqqj-4p63-rrmm (opens in a new tab)

References (116)

• https://github.com/netty/netty/issues/9866 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final (opens in a new tab)x_refsource_MISCx_transferred
• [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-list
• [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-list
• [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-list
• [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)
• https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)
• [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)
• https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)
• https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)
• [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 (opens in a new tab)mailing-list
• [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 (opens in a new tab)mailing-list
• [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 (opens in a new tab)mailing-list
• https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)
• [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)
• https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)
• [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-list
• https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)
• RHSA-2020:0497 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities (opens in a new tab)mailing-list
• [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, (opens in a new tab)mailing-list
• [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• RHSA-2020:0601 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0606 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0605 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0567 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-list
• [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-list
• RHSA-2020:0806 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0811 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0804 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0805 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 (opens in a new tab)mailing-list
• [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 (opens in a new tab)mailing-list
• [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 (opens in a new tab)mailing-list
• [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image (opens in a new tab)mailing-list
• [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-list
• [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-list
• USN-4532-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• FEDORA-2020-66b5f85ccc (opens in a new tab)vendor-advisory
• [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) (opens in a new tab)mailing-list
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-list
• [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-list
• [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-list
• [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-list
• DSA-4885 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx (opens in a new tab)mailing-list
• [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 (opens in a new tab)mailing-list
• https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-20444/5.0.0.Alpha1/exploit (opens in a new tab)
• [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java8 #38 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-branch36-java11 #39 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200204 Build failed in Jenkins: zookeeper-master-maven-jdk11 #361 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200219 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200219 [jira] [Assigned] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200224 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200225 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200309 [jira] [Updated] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200309 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-commits] 20200309 [hadoop] branch trunk updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-commits] 20200309 [hadoop] branch branch-3.2 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-commits] 20200309 [hadoop] branch branch-3.1 updated: HADOOP-16871. Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444, CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hadoop-common-issues] 20200310 [jira] [Commented] (HADOOP-16871) Upgrade Netty version to 4.1.45.Final to handle CVE-2019-20444,CVE-2019-16869 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• FEDORA-2020-66b5f85ccc (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• [camel-commits] 20201120 [camel] branch camel-2.25.x updated: Updating Netty to 4.1.48.Final to fix some CVEs (e.g. CVE-2019-16869, CVE-2019-20444) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-cqqj-4p63-rrmm (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-20444](https://trackcve.app/badge/CVE-2019-20444.svg)](https://trackcve.app/cve/CVE-2019-20444)

Record last updated 8 Oct 2026, 21:14 UTC.