CVE-2019-20445: apache spark
Modified
AliasesUBUNTU-CVE-2019-20445DEBIAN-CVE-2019-20445CGA-3vr4-qxgx-xqhcCGA-48fr-m229-547rCGA-56h8-p2x4-9h6hCGA-93m2-7v83-fhv6CGA-chpx-6jp7-pxq3CGA-p6pf-9562-53cqCGA-2fgp-r738-9q9cCGA-3954-w55q-m8v5CGA-3x5v-m59j-96g7CGA-4c7w-7whg-rx37CGA-4w2q-2p9w-3jqgCGA-6f63-qjpj-4xc5CGA-7vq6-gjhj-4hxfCGA-8477-7fgg-947vCGA-g5cg-7rj9-6prrCGA-gjj8-xm79-7grrCGA-hgj6-vpfq-2cghCGA-hrw6-6gm4-f739GHSA-p2v9-g2qv-p635
Published 29-01-2020Last modified 08-10-2026
Vulnerability summary
CVE-2019-20445 is a critical (CVSS 9.1) vulnerability in apache spark. EPSS estimates a 13.83% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
13.83%
0%100%
Medium · +0.36 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 14 · Related 6Timeline
- 29-01-2020PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
CVSS metrics
6 scores · 5 sources · 2 versionsCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
13.83%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
Increase +0.36 pp
From 13.47% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNetty
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard4 products
- druidAll versions (No fix recorded)
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Debian2 products
- netty< 1:4.1.45-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Io.netty2 products
- nettyAll versions (No fix recorded)
- netty-handler≥ 4.0.0, < 4.1.45
Redhat2 products
Ubuntu2 products
- netty< 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | All versions (No fix recorded) | < 1:4.1.7-4ubuntu0.1
- netty-3.9< 3.9.0.Final-1ubuntu0.1 | < 3.9.9.Final-1+deb9u1build0.18.04.1
Apache1 product
- sparkEOL2.4.7 | 2.4.8
Canonical1 product
- ubuntu_linuxEOL18.04
Fedoraproject1 product
- fedoraEOL33
Netty1 product
- netty< 4.1.44
Org.jboss.netty1 product
- nettyAll versions (No fix recorded)
Wolfi1 product
- druidAll versions (No fix recorded)
11 vendors · 18 products
References
101 links- github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.FinalX Refsource MISCREPORTFIXWEBPatchRelease NotesThird Party Advisory
- github.com/netty/netty/issues/9861X Refsource MISCREPORTFIXWEBExploitIssue TrackingPatchThird Party Advisory
Show all 100 references
- access.redhat.com/errata/RHSA-2020:0497Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2020/02/msg00017.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory- lists.debian.org/debian-lts-announce/2020/02/msg00018.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0601Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0606Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0605Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0567Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0806Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0811Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0804Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0805Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/09/msg00004.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/09/msg00003.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
- www.debian.org/security/2021/dsa-4885Vendor AdvisoryX Refsource DEBIANAdvisoryWEBThird Party Advisory
- github.com/netty/nettyPACKAGE
Showing 100 of 101.