Source Package: netty (1:4.1.48-10+deb13u1)
Java NIO client/server socket framework
The following binary packages are built from this source package:
- libnetty-java
Java NIO client/server socket framework
Packages / Debian 13 (Trixie) / Source / java / netty
Bekannte Sicherheitslücken
Die Paketzuordnung läuft.
| CVE | Schweregrad | Betroffene Versionen |
|---|---|---|
| [CVE-2026-100666] Published: Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request | High(7.3) | UnbekanntDetails (4)
|
| [CVE-2026-93579] Published: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93578] Published: A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attac | High(7.4) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93576] Published: A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an applica | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93575] Published: A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate th | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93572] Published: A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `Redis | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93569] Published: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-t | High(8.2) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93568] Published: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly p | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93567] Published: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93563] Published: A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unboun | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93561] Published: A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the pro | Medium(6.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93560] Published: A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulner | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93494] Published: A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This cau | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93493] Published: A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optio | High(7.4) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-93492] Published: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an | Medium(5.3) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-100655] Published: Rejected reason: This CVE ID has been rejected as a duplicate. | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-100656] Published: Rejected reason: This CVE ID has been rejected as a duplicate. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-100657] Published: Rejected reason: This CVE ID has been rejected as a duplicate. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-89044] Published: Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smug | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-75595] Published: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading t | Critical(9.1) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
Zuletzt synchronisiert:
Quellen
- Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record- Signed object
- https://deb.debian.org/debian/dists/trixie/InRelease
- Signed-object SHA-256
- 98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
- Observed SHA-256
- 3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
- Result
- match verified
- Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record- Signed object
- https://deb.debian.org/debian/dists/trixie/InRelease
- Signed-object SHA-256
- 98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
- Observed SHA-256
- 753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
- Result
- match verified
- Debian 13 (Trixie) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-arm64:a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Repository-signature verification record- Signed-object SHA-256
- fb4f5284b755510aafc1d8a39ef966c7ef714aaab3ecc24baae0a67c38518ab5
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
- Observed SHA-256
- a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
- Result
- match verified
- Debian SecurityOct 29, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-amd64:00b130f61091f3df9d3654225afb2cf21447e3fdecdbead0f367f0e6348d4b1d
Repository-signature verification record- Signed-object SHA-256
- 3fb26940f9e9c1b15e724fe78dba57182518d4b1a72a0d2372fc7829a4252268
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Oct 29, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 00b130f61091f3df9d3654225afb2cf21447e3fdecdbead0f367f0e6348d4b1d
- Observed SHA-256
- 00b130f61091f3df9d3654225afb2cf21447e3fdecdbead0f367f0e6348d4b1d
- Result
- match verified