CVE-2019-20444: Canonical Ubuntu Linux

Critical severity, CVSS 9.1. EPSS: 8.9% chance of exploitation in the next 30 days.

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only
• Netty Netty: before 4.1.44 (fixed in 4.1.44)
• Red Hat JBoss Amq Clients: version 2 only
• Red Hat JBoss Enterprise Application Platform: version 7.2 only; version 7.3 only

Published 2020-01-29. Last modified 2026-10-08.