CVE-2020-7238: Debian Linux

High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days.

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only
• Netty Netty: version 4.1.43 only
• Red Hat JBoss Enterprise Application Platform: version 7.2 only; version 7.3 only; version 7.4 only
• Red Hat JBoss Enterprise Application Platform Text-Only Advisories: affected versions not specified
• Red Hat Openshift Application Runtimes Text-Only Advisories: affected versions not specified

Published 2020-01-27. Last modified 2026-06-17.