Source Package: netty (1:4.1.48-7+deb12u2)
Java NIO client/server socket framework
The following binary packages are built from this source package:
- libnetty-java
Java NIO client/server socket framework
Packages / Debian 12 (Bookworm) / Source / java / netty
Bekannte Sicherheitslücken
Die Paketzuordnung läuft.
| CVE | Schweregrad | Betroffene Versionen |
|---|---|---|
| [CVE-2026-100666] Published: Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request | High(7.3) | UnbekanntDetails (4)
|
| [CVE-2026-93579] Published: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93578] Published: A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attac | High(7.4) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93576] Published: A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an applica | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93575] Published: A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate th | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93574] Published: A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespac | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93573] Published: A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple hea | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93572] Published: A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `Redis | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93569] Published: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-t | High(8.2) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93568] Published: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly p | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93567] Published: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93566] Published: A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended stri | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93565] Published: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attac | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93564] Published: A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead t | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93563] Published: A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unboun | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93562] Published: A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP r | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93561] Published: A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the pro | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93560] Published: A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulner | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93558] Published: A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93494] Published: A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This cau | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
Zuletzt synchronisiert:
Quellen
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified
- Debian 12 (Bookworm) security main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
bookworm-security-main-amd64:f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Repository-signature verification record- Signed-object SHA-256
- 6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
- Signer fingerprint
- ED541312A33F1128F10B1C6C54404762BBB6E853
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
- Observed SHA-256
- f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
- Result
- match verified
- Debian 12 (Bookworm) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
bookworm-security-main-arm64:f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Repository-signature verification record- Signed-object SHA-256
- 6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
- Signer fingerprint
- ED541312A33F1128F10B1C6C54404762BBB6E853
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
- Observed SHA-256
- f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
- Result
- match verified