CVE-2019-20444: canonical ubuntu_linux
Vulnerability summary
CVE-2019-20444 is a critical (CVSS 9.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 8.91% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 5Timeline
- 29-01-2020PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
8.91%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 8.91% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNetty
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard4 products
- druid< 34.0.0-r6 | All versions (No fix recorded)
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Debian2 products
- netty< 1:4.1.45-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Io.netty2 products
- nettyAll versions (No fix recorded)
- netty-codec-http< 4.1.44
Redhat2 products
Ubuntu2 products
- netty< 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | All versions (No fix recorded) | < 1:4.1.7-4ubuntu0.1
- netty-3.9< 3.9.0.Final-1ubuntu0.1 | < 3.9.9.Final-1+deb9u1build0.18.04.1
Canonical1 product
- ubuntu_linuxEOL18.04
Fedoraproject1 product
- fedoraEOL33
Netty1 product
- netty< 4.1.44
Org.jboss.netty1 product
- nettyAll versions (No fix recorded)
Wolfi1 product
- druid< 34.0.0-r6 | All versions (No fix recorded)
10 vendors · 17 products
References
129 links- github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.FinalREPORTFIXWEBPatchThird Party Advisory
Show all 100 references
lists.debian.org/debian-lts-announce/2020/02/msg00017.htmlMailing ListAdvisoryWEBThird Party Advisory- lists.debian.org/debian-lts-announce/2020/02/msg00018.htmlMailing ListAdvisoryWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/09/msg00004.htmlMailing ListAdvisoryWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/09/msg00003.htmlMailing ListAdvisoryWEBThird Party Advisory
Showing 100 of 129.