Debian Netty vulnerabilities

CVE-2023-44487 [HIGH] CVE-2023-44487: dnsdist - The HTTP/2 protocol allows a denial of service (server resource consumption) bec... The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 1.8.2-2) sid: resolved (fixed in 1.8.2-2) trixie: resolved (fixed in 1.8.2-2)

CVE-2019-20445 [CRITICAL] CVE-2019-20445: netty - HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to ... HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. Scope: local bookworm: resolved (fixed in 1:4.1.45-1) bullseye: resolved (fixed in 1:4.1.45-1) forky: resolved (fixed in 1:4.1.45-1) sid: resolved (fixed in 1:4.1.45-1) trixie: resolved (fixed in 1:4.1.

CVE-2019-20444 [CRITICAL] CVE-2019-20444: netty - HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a... HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." Scope: local bookworm: resolved (fixed in 1:4.1.45-1) bullseye: resolved (fixed in 1:4.1.45-1) forky: resolved (fixed in 1:4.1.45-1) sid: resolved (fixed in 1

CVE-2021-21295 [MEDIUM] CVE-2021-21295: netty - Netty is an open-source, asynchronous event-driven network application framework... Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field i

CVE-2020-11612 [HIGH] CVE-2020-11612: netty - The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocat... The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder. Scope: local bookworm: resolved (fixed in 1:4.1.48-1) bullseye: resolved (fixed in 1:4.1.48-1

CVE-2019-16869 [HIGH] CVE-2019-16869: netty - Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers... Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Scope: local bookworm: resolved (fixed in 1:4.1.33-2) bullseye: resolved (fixed in 1:4.1.33-2) forky: resolved (fixed in 1:4.1.33-2) sid: resolved (fixed in 1:4.1.33-2) trixie: resolved (fixed in 1:4.1.

CVE-2021-37137 [HIGH] CVE-2021-37137: netty - The Snappy frame decoder function doesn't restrict the chunk length which may le... The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network s

CVE-2015-2156 [HIGH] CVE-2015-2156: netty - Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final,... Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. Scope: local bookworm: resolved (fixed in 1:4.0.31-1)

CVE-2021-37136 [HIGH] CVE-2021-37136: netty - The Bzip2 decompression decoder function doesn't allow setting size restrictions... The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack Scope: local bookworm: resolved (fixed in 1:4.1.48-6) bullseye: resolved (fixed in 1:4.1.48-4+

CVE-2016-4970 [HIGH] CVE-2016-4970: netty - handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x befo... handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop). Scope: local bookworm: resolved (fixed in 1:4.0.37-1) bullseye: resolved (fixed in 1:4.0.37-1) forky: resolved (fixed in 1:4.0.37-1) sid: resolved (fixed in 1:4.0.37-1) trixie: resolved (fixed in 1:4.0.37-1)

CVE-2025-58057 [MEDIUM] CVE-2025-58057: netty - Netty is an asynchronous event-driven network application framework for rapid de... Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allo

CVE-2025-55163 [HIGH] CVE-2025-55163: netty - Netty is an asynchronous, event-driven network application framework. Prior to v... Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denia

CVE-2025-59419 [MEDIUM] CVE-2025-59419: netty - Netty is an asynchronous, event-driven network application framework. In version... Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.s

CVE-2025-58056 [LOW] CVE-2025-58056: netty - Netty is an asynchronous event-driven network application framework for developm... Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requir

CVE-2020-7238 [HIGH] CVE-2020-7238: netty - Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-... Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869. Scope: local bookworm: resolved (fixed in 1:4.1.45-1) bullseye: resolved (fixed in 1:4.1.45-1) forky: resolved (fixed in

CVE-2025-67735 [MEDIUM] CVE-2025-67735: netty - Netty is an asynchronous, event-driven network application framework. In version... Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application

CVE-2022-41881 [MEDIUM] CVE-2022-41881: netty - Netty project is an event-driven asynchronous network application framework. In ... Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder. Scope: local bookworm: resolved (f

CVE-2021-21409 [MEDIUM] CVE-2021-21409: netty - Netty is an open-source, asynchronous event-driven network application framework... Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a s

CVE-2023-34462 [MEDIUM] CVE-2023-34462: netty - Netty is an asynchronous event-driven network application framework for rapid de... Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to

CVE-2021-43797 [MEDIUM] CVE-2021-43797: netty - Netty is an asynchronous event-driven network application framework for rapid de... Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request