io.jooby/jooby-netty vulnerabilities

Latest io.jooby/jooby-netty CVEs

Newest publication first

1. CVE-2020-7622 Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

   Published 2020-04-06

   Critical·CVSS 9.8 EPSS 1.6%

   This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.