netty (1:4.1.48-16) unstable; urgency=medium

  * Team upload
  * Fix d/copyright link
  * Upload to unstable

 -- Bastien Roucariès <rouca@debian.org>  Sun, 08 Feb 2026 05:46:43 +0100

netty (1:4.1.48-15) experimental; urgency=medium

  * Team upload
  * Split package for preparing upgrade
  * Fix CVE-2025-67735 (Closes: #1123606)
    `io.netty.handler.codec.http.HttpRequestEncoder`
    has a CRLF injection with the request URI when constructing
    a request. This leads to request smuggling when
    `HttpRequestEncoder` is used without proper sanitization
    of the URI. Any application / framework using `HttpRequestEncoder`
    can be subject to be abused to perform request smuggling using
    CRLF injection

 -- Bastien Roucariès <rouca@debian.org>  Mon, 12 Jan 2026 00:43:40 +0100

netty (1:4.1.48-14) unstable; urgency=medium

  * Team upload
  * Multi-Arch: foreign

 -- Bastien Roucariès <rouca@debian.org>  Wed, 03 Dec 2025 17:24:25 +0100

netty (1:4.1.48-13) unstable; urgency=high

  * Team upload
  * Fix test for junit4 for CVE-2025-58057 improving
    backporting. Thanks to Edwin Jiang.
  * Fix CVE-2025-58056 (Closes: #1113995)
    Netty incorrectly accepts standalone newline
    characters (LF) as a chunk-size line terminator,
    regardless of a preceding carriage return (CR),
    instead of requiring CRLF per HTTP/1.1 standards.
    When combined with reverse proxies that parse LF
    differently (treating it as part of the
    chunk extension), attackers can craft requests
    that the proxy sees as one request but Netty
    processes as two, enabling request smuggling attacks. 

 -- Bastien Roucariès <rouca@debian.org>  Tue, 25 Nov 2025 23:06:00 +0100

netty (1:4.1.48-12) unstable; urgency=high

  * Team upload
  * Fix CVE-2025-58057:
    When supplied with specially crafted input, BrotliDecoder
    and certain other decompression decoders will allocate
    a large number of reachable byte buffers, which can lead
    to denial of service. BrotliDecoder.decompress has no limit
    in how often it calls pull, decompressing data 64K bytes at
    a time. The buffers are saved in the output list, and remain
    reachable until OOM is hit.
    (Closes: #1113994)

 -- Bastien Roucariès <rouca@debian.org>  Sun, 16 Nov 2025 09:30:49 +0100

netty (1:4.1.48-11) unstable; urgency=high

  * Team upload
  * Fix CVE-2025-55163 (Closes: #1111105)
    Netty is vulnerable to MadeYouReset DDoS.
    This is a logical vulnerability in the HTTP/2 protocol,
    that uses malformed HTTP/2 control frames in order to break
    the max concurrent streams limit, which results in resource
    exhaustion and distributed denial of service.
  * Fix CVE-2025-59419 (Closes: #1118282)
    SMTP Command Injection Vulnerability Allowing Email Forgery
    An SMTP Command Injection (CRLF Injection) vulnerability
    in Netty's SMTP codec allows a remote attacker who can control
    SMTP command parameters (e.g., an email recipient)
    to forge arbitrary emails from the trusted server.
    This bypasses standard email authentication and can
    be used to impersonate executives and forge high-stakes
    corporate communications.

 -- Bastien Roucariès <rouca@debian.org>  Sat, 15 Nov 2025 10:09:07 +0100

netty (1:4.1.48-10) unstable; urgency=high

  * Team upload.
  * Fix CVE-2024-29025:
    Julien Viet discovered that Netty, a Java NIO client/server socket
    framework, was vulnerable to allocation of resources without limits or
    throttling due to the accumulation of data in the HttpPostRequestDecoder.
    This would allow an attacker to cause a denial of service.
    Thanks to Salvatore Bonaccorso for the report. (Closes: #1068110)

 -- Markus Koschany <apo@debian.org>  Sun, 12 May 2024 21:20:10 +0200

netty (1:4.1.48-9) unstable; urgency=medium

  * Team upload.
  * d/p/22-java-21.patch: apply upstream Java 21 compatibility patch
    (Closes: #1053066).

 -- Vladimir Petko <vladimir.petko@canonical.com>  Tue, 28 Nov 2023 08:30:44 +1300

netty (1:4.1.48-8) unstable; urgency=medium

  * Team upload.
  * Fix CVE-2023-34462: (Closes: #1038947)
    Guard against high memory usage when parsing ClientHello messages.
  * Fix CVE-2023-44487: (Closes: #1054234)
    The HTTP/2 protocol allows a denial of service (server resource
    consumption) because request cancellation can reset many streams quickly.

 -- Markus Koschany <apo@debian.org>  Sun, 05 Nov 2023 21:07:13 +0100

netty (1:4.1.48-7) unstable; urgency=medium

  * Team upload
  * Raising Standards version to 4.6.2 (no change)
  * Build-depending on log4j1.2-java (Closes: #1028805)
  * Removing unneeded versioned build-dependencies
  * Fixing debian/copyright syntax:
    - Comments field name turned into Comment
    - MIT license name turned into Expat
  * Honouring filenamemangle in d/watch
  * Update lintian override info format in d/libnetty-java.lintian-overrides
  * Use secure URI in Homepage field.
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.

 -- Pierre Gruet <pgt@debian.org>  Sun, 22 Jan 2023 17:43:44 +0100

netty (1:4.1.48-6) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-37136, CVE-2021-37137, CVE-2021-43797, CVE-2022-41881,
    and CVE-2022-41915. Several out-of-memory, stack overflow or HTTP request
    smuggling vulnerabilities have been discovered in Netty which may allow
    attackers to cause a denial of service or bypass restrictions when used as
    a proxy. (Closes: #1027180, #1014769, #1001437)

 -- Markus Koschany <apo@debian.org>  Sun, 01 Jan 2023 19:17:21 +0100

netty (1:4.1.48-5) unstable; urgency=medium

  * Team upload.
  * Fix FTBFS on Java 17 (Closes: #1011135)

 -- tony mancill <tmancill@debian.org>  Wed, 25 May 2022 22:09:22 -0700

netty (1:4.1.48-4) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-21409 (Closes: #986217)
    Address a vulnerability that enables request smuggling. The content-length
    header is not correctly validated if the request only uses a single
    Http2HeaderFrame with the endStream set to true. This could lead to request
    smuggling if the request is proxied to a remote peer and translated to
    HTTP/1.1.  This is a followup to CVE-2021-21295 to address this case.

 -- tony mancill <tmancill@debian.org>  Wed, 31 Mar 2021 22:01:52 -0700

netty (1:4.1.48-3) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-21295:
    There is a vulnerability that enables request smuggling. If a
    Content-Length header is present in the original HTTP/2 request, the field
    is not validated by `Http2MultiplexHandler` as it is propagated up. This is
    fine as long as the request is not proxied through as HTTP/1.1. If the
    request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1
    domain objects (`HttpRequest`, `HttpContent`, etc.) via
    `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's
    pipeline and proxied through a remote peer as HTTP/1.1 this may result in
    request smuggling. (Closes: #984948)

 -- Markus Koschany <apo@debian.org>  Fri, 26 Mar 2021 13:37:15 +0100

netty (1:4.1.48-2) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-21290:
    In Netty there is a vulnerability on Unix-like systems involving an
    insecure temp file. When netty's multipart decoders are used local
    information disclosure can occur via the local system temporary directory
    if temporary storing uploads on the disk is enabled. On unix-like systems,
    the temporary directory is shared between all user. As such, writing to
    this directory using APIs that do not explicitly set the file/directory
    permissions can lead to information disclosure. Thanks to Salvatore
    Bonaccorso for the report. (Closes: #982580)
  * Switch to debhelper-compat = 13.
  * Declare compliance with Debian Policy 4.5.1.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Feb 2021 00:17:55 +0100

netty (1:4.1.48-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 06 Apr 2020 00:17:03 +0200

netty (1:4.1.45-2) unstable; urgency=medium

  * Team upload.
  * Enable building of transport-native-kqueue.
    - Needed to update async-http-client.

 -- Sudip Mukherjee <sudipm.mukherjee@gmail.com>  Fri, 20 Mar 2020 16:35:51 +0000

netty (1:4.1.45-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Fixes CVE-2019-20444, CVE-2019-20445 and CVE-2020-7238
      (Closes: #950966, #950967)
    - Refreshed the patches
    - Updated the Maven rules
    - Depend on libnetty-tcnative-java (>= 2.0.28)
    - Disabled the native image support due to missing dependencies
    - Disabled the BlockHound integration
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 17:10:37 +0100

netty (1:4.1.33-3) unstable; urgency=medium

  * Team upload.
  * Apply patch for FTBFS on 32-bit architectures. (Closes: #923455)
    Thank you to Sjoerd Simons for the patch.
  * Set "Rules-Requires-Root: no" in debian/control
  * Specify debhelper compat 12 via debhelper-compat dependency
  * Bump Standards-Version to 4.4.1

 -- tony mancill <tmancill@debian.org>  Wed, 08 Jan 2020 20:40:19 -0800

netty (1:4.1.33-2) unstable; urgency=high

  * Team upload.
  * Correctly handle whitespaces in HTTP header names as defined by
    RFC7230#section-3.2.4 (CVE-2019-16869) (Closes: #941266)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 02 Jan 2020 20:47:57 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libnetty-common-java`.
