Source Package: netty (1:4.1.48-10+deb13u1)
Java NIO client/server socket framework
The following binary packages are built from this source package:
- libnetty-java
Java NIO client/server socket framework
Packages / Debian 13 (Trixie) / Source / java / netty
Bekannte Sicherheitslücken
Die Paketzuordnung läuft.
| CVE | Schweregrad | Betroffene Versionen |
|---|---|---|
| [CVE-2026-44892] Published: Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 c | High(7.5) | BetroffenDetails (2)
|
| [CVE-2026-50009] Published: Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the | Medium(4.8) | BetroffenDetails (2)
|
| [CVE-2026-42577] Published: Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after bein | High(7.5) | BetroffenDetails (2)
|
| [CVE-2026-100666] Published: Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request | High(7.3) | UnbekanntDetails (2)
|
| [CVE-2026-93579] Published: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due | Medium(6.5) | UnbekanntDetails (2)
|
| [CVE-2026-93578] Published: A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attac | High(7.4) | UnbekanntDetails (2)
|
| [CVE-2026-93576] Published: A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an applica | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93575] Published: A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate th | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93574] Published: A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespac | Medium(6.5) | UnbekanntDetails (2)
|
| [CVE-2026-93573] Published: A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple hea | Medium(6.5) | UnbekanntDetails (2)
|
| [CVE-2026-93572] Published: A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `Redis | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93569] Published: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-t | High(8.2) | UnbekanntDetails (2)
|
| [CVE-2026-93568] Published: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly p | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93567] Published: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93566] Published: A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended stri | Medium(6.5) | UnbekanntDetails (2)
|
| [CVE-2026-93565] Published: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attac | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93564] Published: A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead t | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93563] Published: A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unboun | High(7.5) | UnbekanntDetails (2)
|
| [CVE-2026-93562] Published: A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP r | Medium(6.5) | UnbekanntDetails (2)
|
| [CVE-2026-93561] Published: A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the pro | Medium(6.5) | UnbekanntDetails (2)
|
Zuletzt synchronisiert:
Quellen
- Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record- Signed object
- https://deb.debian.org/debian/dists/trixie/InRelease
- Signed-object SHA-256
- 98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
- Observed SHA-256
- 3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
- Result
- match verified
- Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record- Signed object
- https://deb.debian.org/debian/dists/trixie/InRelease
- Signed-object SHA-256
- 98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
- Observed SHA-256
- 753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
- Result
- match verified
- Debian 13 (Trixie) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-arm64:a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Repository-signature verification record- Signed-object SHA-256
- fb4f5284b755510aafc1d8a39ef966c7ef714aaab3ecc24baae0a67c38518ab5
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
- Observed SHA-256
- a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
- Result
- match verified
- Debian SecurityOct 29, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-amd64:00b130f61091f3df9d3654225afb2cf21447e3fdecdbead0f367f0e6348d4b1d
Repository-signature verification record- Signed-object SHA-256
- 83418b3b53f7e635f6f7b43f15bb1fc89e3b5fd62df5d8db73c7160923d0ffcd
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Oct 29, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 00b130f61091f3df9d3654225afb2cf21447e3fdecdbead0f367f0e6348d4b1d
- Observed SHA-256
- 00b130f61091f3df9d3654225afb2cf21447e3fdecdbead0f367f0e6348d4b1d
- Result
- match verified