| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty | all versions | |
| io.netty:netty-handler | ≥ 4.0.0, < 4.1.45 | 4.1.45 |
| org.jboss.netty:netty | all versions | |
| spark | = 2.4.7= 2.4.8 | |
| netty | < 4.1.44 | 4.1.44 |
| jboss amq clients | = 2 | |
| jboss enterprise application platform | = 7.2= 7.3 |
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free