{
    "id": "CVE-2019-20444",
    "published": "2020-01-29 21:15:11",
    "last_modified": "2026-06-17 02:30:27",
    "cvss_score": "9.1",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
    "cwe": "CWE-444",
    "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"",
    "epss_score": "0.08914",
    "epss_percentile": "0.95096",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 0,
    "updated_at": "2026-10-05 18:17:20",
    "priority": {
        "rank": 3,
        "label": "In your normal cycle",
        "why": "Critical by CVSS (9.1), but no sign of active exploitation."
    },
    "products": [
        {
            "vendor": "canonical",
            "product": "ubuntu_linux"
        },
        {
            "vendor": "debian",
            "product": "debian_linux"
        },
        {
            "vendor": "fedoraproject",
            "product": "fedora"
        },
        {
            "vendor": "netty",
            "product": "netty"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux"
        },
        {
            "vendor": "redhat",
            "product": "jboss_amq_clients"
        },
        {
            "vendor": "redhat",
            "product": "jboss_enterprise_application_platform"
        }
    ],
    "kev_detail": null,
    "exploits": [],
    "refs_list": [
        "https://access.redhat.com/errata/RHSA-2020:0497",
        "https://access.redhat.com/errata/RHSA-2020:0567",
        "https://access.redhat.com/errata/RHSA-2020:0601",
        "https://access.redhat.com/errata/RHSA-2020:0605",
        "https://access.redhat.com/errata/RHSA-2020:0606",
        "https://access.redhat.com/errata/RHSA-2020:0804",
        "https://access.redhat.com/errata/RHSA-2020:0805",
        "https://access.redhat.com/errata/RHSA-2020:0806",
        "https://access.redhat.com/errata/RHSA-2020:0811",
        "https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final",
        "https://github.com/netty/netty/issues/9866",
        "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-20444/5.0.0.Alpha1/exploit",
        "https://lists.apache.org/thread.html/r059b042bca47be53ff8a51fd04d95eb01bb683f1afa209db136e8cb7@%3Cdev.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E",
        "https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E",
        "https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5@%3Cissues.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d@%3Cdev.geode.apache.org%3E",
        "https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f@%3Cissues.spark.apache.org%3E",
        "https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r34912a9b1a5c269a77b8be94ef6fb6d1e9b3c69129719dc00f01cf0b@%3Cdev.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62@%3Cissues.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r489886fe72a98768eed665474cba13bad8d6fe0654f24987706636c5@%3Cdev.zookeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E"
    ]
}