CVE-2020-7622

Published: Apr 6, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

Affected (2)

Products: Jooby: Jooby

Jooby

1 product

Jooby

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Jooby Jooby	Before 1.6.9
Jooby Jooby	From 2.0.0 to 2.2.1

References (6)

https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.