CVE-2019-16869: canonical ubuntu_linux
Vulnerability summary
CVE-2019-16869 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 8.64% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 2Timeline
- 26-09-2019PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
8.64%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
Increase +0.23 pp
From 8.42% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNetty
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard4 products
- druidAll versions (No fix recorded)
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Debian2 products
- netty< 1:4.1.33-2 | < 1:4.1.7-2+deb9u1 | < 1:4.1.33-1+deb10u1 | < 1:3.2.6.Final-2+deb8u1
- debian_linuxEOL8.0 | 9.0 | 10.0
Io.netty2 products
- netty≥ 3.3.0.Final, ≤ 4.0.0.Alpha8
- netty-all≥ 4.0.0.Beta1, < 4.1.42.Final
Ubuntu2 products
- netty< 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | All versions (No fix recorded)
- netty-3.9< 3.9.0.Final-1ubuntu0.1 | < 3.9.9.Final-1+deb9u1build0.18.04.1
Canonical1 product
- ubuntu_linuxEOL18.04
Netty1 product
- netty< 4.1.42
Org.jboss.netty1 product
- netty≤ 3.2.9.Final
Redhat1 product
- jboss_enterprise_application_platform7.2 | 7.3 | 7.4
Wolfi1 product
- druidAll versions (No fix recorded)
9 vendors · 15 products
References
155 links- github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.FinalPatchThird Party AdvisoryREPORTFIXWEB
lists.debian.org/debian-lts-announce/2019/09/msg00035.htmlMailing ListThird Party AdvisoryAdvisoryWEB
Show all 100 references
- lists.debian.org/debian-lts-announce/2020/02/msg00018.htmlMailing ListThird Party AdvisoryAdvisoryWEB
- lists.debian.org/debian-lts-announce/2020/09/msg00004.htmlMailing ListThird Party AdvisoryAdvisoryWEB
Showing 100 of 155.