CVE-2019-20445: Apache Spark

Critical severity, CVSS 9.1. EPSS: 13.5% chance of exploitation in the next 30 days.

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Affected products

• Apache Spark: version 2.4.7 only; version 2.4.8 only
• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only
• Netty Netty: before 4.1.44 (fixed in 4.1.44)
• Red Hat JBoss Amq Clients: version 2 only
• Red Hat JBoss Enterprise Application Platform: version 7.2 only; version 7.3 only

Published 2020-01-29. Last modified 2026-10-08.