CVE-2020-7238: debian debian_linux
Vulnerability summary
CVE-2020-7238 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 3.65% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 1Timeline
- 27-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.65%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.65% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCve 2020 72381
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat3 products
Debian2 products
- netty< 1:4.1.45-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Ubuntu2 products
- netty< 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1 | All versions (No fix recorded)
- netty-3.9< 3.9.0.Final-1ubuntu0.1
Fedoraproject1 product
- fedoraEOL33
Io.netty1 product
- netty-handler≥ 4.1.43, < 4.1.45
Netty1 product
- netty4.1.43
6 vendors · 10 products
References
30 links
lists.debian.org/debian-lts-announce/2020/02/msg00017.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- lists.debian.org/debian-lts-announce/2020/02/msg00018.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
Show all 30 references
- lists.debian.org/debian-lts-announce/2020/09/msg00003.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
