Description

Reactor Netty, versions 0.8.x prior to 0.8.13 and 0.9.x prior to 0.9.1, depends on vulnerable versions of netty (versions prior to 4.1.42), which incorrectly handles whitespace before a colon in headers, leading to HTTP request smuggling attacks.

References

• https://pivotal.io/security/cve-2019-16869
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-16869

History

2019-10-28: Initial vulnerability report published.