HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
https://www.debian.org/security/2021/dsa-4885
https://usn.ubuntu.com/4532-1/
https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html
https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html
https://github.com/netty/netty/issues/9861
https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final
https://access.redhat.com/errata/RHSA-2020:0811
https://access.redhat.com/errata/RHSA-2020:0806
https://access.redhat.com/errata/RHSA-2020:0805
https://access.redhat.com/errata/RHSA-2020:0804
https://access.redhat.com/errata/RHSA-2020:0606
https://access.redhat.com/errata/RHSA-2020:0605
https://access.redhat.com/errata/RHSA-2020:0601