netty (1:4.1.48-16ubuntu1) stonking; urgency=medium

  * SECURITY UPDATE: Improper Neutralization of CRLF Sequences in HTTP Headers
    - debian/patches/CVE-2026-42578_1.patch: Validate headers by default in
      handler-proxy/.../HttpProxyHandler.java. Add test in
      handler-proxy/.../HttpProxyHandlerTest.java.
    - debian/patches/CVE-2026-42578_2.patch: Re-add constructor to
      HttpProxyHandler that was removed by mistake in
      handler-proxy/.../HttpProxyHandler.java.
    - CVE-2026-42578
  * SECURITY UPDATE: Improper Input Validation 
    - debian/patches/CVE-2026-42579_1.patch: Validate token length and domain
      name length in codec-dns/.../DnsCodecUtil.java,
      codec-dns/.../DnsCodecUtilTest.java.
    - debian/patches/CVE-2026-42579_2.patch: Fix codec-dns tests in
      codec-dns/.../DnsCodecUtil.java, codec-dns/.../DnsCodecUtilTest.java.
    - CVE-2026-42579
  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2026-42581.patch: Throw error if decoding an HTTP/1.0
      message with both Transfer-Encoding and Content-Length in
      codec-http/.../ContentLengthNotAllowedException.java,
      codec-http/.../HttpObjectDecoder.java,
      codec-http/.../HttpRequestDecoder.java,
      codec-http/.../HttpResponseDecoder.java,
      codec-http/.../HttpServerCodec.java,
      codec-http/.../TransferEncodingNotAllowedException.java,
      codec-http/.../HttpInvalidMessageTest.java,
      codec-http/.../HttpRequestDecoderTest.java,
      codec-http/.../HttpResponseDecoderTest.java,
      codec-http/.../HttpServerCodecTest.java,
      codec-http/.../HttpServerKeepAliveHandlerTest.java.
    - CVE-2026-42581
  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2026-42584.patch: Fix request/response pairing in
      codec-http/.../HttpClientCodec.java. Add test in
      codec-http/.../HttpClientCodecTest.java.
    - CVE-2026-42584
  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2026-42585-1.patch: Validate that chunked is the last
      encoding in codec-http/.../HttpObjectDecoder.java. Add test in
      codec-http/.../HttpRequestDecoderTest.java.
    - debian/patches/CVE-2026-42585-2.patch: Fix checkstyle in
      codec-http/.../HttpObjectDecoder.java.
    - CVE-2026-42585
  * SECURITY UPDATE: CRLF Injection
    - debian/patches/CVE-2026-42586.patch: Reject messages with CR or LF in
      codec-redis/.../RedisEncoder.java.
    - CVE-2026-42586

 -- Edwin Jiang <edwin.jiang@canonical.com>  Fri, 05 Jun 2026 21:37:31 -0400

netty (1:4.1.48-16) unstable; urgency=medium

  * Team upload
  * Fix d/copyright link
  * Upload to unstable

 -- Bastien Roucariès <rouca@debian.org>  Sun, 08 Feb 2026 05:46:43 +0100

netty (1:4.1.48-15) experimental; urgency=medium

  * Team upload
  * Split package for preparing upgrade
  * Fix CVE-2025-67735 (Closes: #1123606)
    `io.netty.handler.codec.http.HttpRequestEncoder`
    has a CRLF injection with the request URI when constructing
    a request. This leads to request smuggling when
    `HttpRequestEncoder` is used without proper sanitization
    of the URI. Any application / framework using `HttpRequestEncoder`
    can be subject to be abused to perform request smuggling using
    CRLF injection

 -- Bastien Roucariès <rouca@debian.org>  Mon, 12 Jan 2026 00:43:40 +0100

netty (1:4.1.48-14) unstable; urgency=medium

  * Team upload
  * Multi-Arch: foreign

 -- Bastien Roucariès <rouca@debian.org>  Wed, 03 Dec 2025 17:24:25 +0100

netty (1:4.1.48-13) unstable; urgency=high

  * Team upload
  * Fix test for junit4 for CVE-2025-58057 improving
    backporting. Thanks to Edwin Jiang.
  * Fix CVE-2025-58056 (Closes: #1113995)
    Netty incorrectly accepts standalone newline
    characters (LF) as a chunk-size line terminator,
    regardless of a preceding carriage return (CR),
    instead of requiring CRLF per HTTP/1.1 standards.
    When combined with reverse proxies that parse LF
    differently (treating it as part of the
    chunk extension), attackers can craft requests
    that the proxy sees as one request but Netty
    processes as two, enabling request smuggling attacks. 

 -- Bastien Roucariès <rouca@debian.org>  Tue, 25 Nov 2025 23:06:00 +0100

netty (1:4.1.48-12) unstable; urgency=high

  * Team upload
  * Fix CVE-2025-58057:
    When supplied with specially crafted input, BrotliDecoder
    and certain other decompression decoders will allocate
    a large number of reachable byte buffers, which can lead
    to denial of service. BrotliDecoder.decompress has no limit
    in how often it calls pull, decompressing data 64K bytes at
    a time. The buffers are saved in the output list, and remain
    reachable until OOM is hit.
    (Closes: #1113994)

 -- Bastien Roucariès <rouca@debian.org>  Sun, 16 Nov 2025 09:30:49 +0100

netty (1:4.1.48-11) unstable; urgency=high

  * Team upload
  * Fix CVE-2025-55163 (Closes: #1111105)
    Netty is vulnerable to MadeYouReset DDoS.
    This is a logical vulnerability in the HTTP/2 protocol,
    that uses malformed HTTP/2 control frames in order to break
    the max concurrent streams limit, which results in resource
    exhaustion and distributed denial of service.
  * Fix CVE-2025-59419 (Closes: #1118282)
    SMTP Command Injection Vulnerability Allowing Email Forgery
    An SMTP Command Injection (CRLF Injection) vulnerability
    in Netty's SMTP codec allows a remote attacker who can control
    SMTP command parameters (e.g., an email recipient)
    to forge arbitrary emails from the trusted server.
    This bypasses standard email authentication and can
    be used to impersonate executives and forge high-stakes
    corporate communications.

 -- Bastien Roucariès <rouca@debian.org>  Sat, 15 Nov 2025 10:09:07 +0100

netty (1:4.1.48-10) unstable; urgency=high

  * Team upload.
  * Fix CVE-2024-29025:
    Julien Viet discovered that Netty, a Java NIO client/server socket
    framework, was vulnerable to allocation of resources without limits or
    throttling due to the accumulation of data in the HttpPostRequestDecoder.
    This would allow an attacker to cause a denial of service.
    Thanks to Salvatore Bonaccorso for the report. (Closes: #1068110)

 -- Markus Koschany <apo@debian.org>  Sun, 12 May 2024 21:20:10 +0200

netty (1:4.1.48-9) unstable; urgency=medium

  * Team upload.
  * d/p/22-java-21.patch: apply upstream Java 21 compatibility patch
    (Closes: #1053066).

 -- Vladimir Petko <vladimir.petko@canonical.com>  Tue, 28 Nov 2023 08:30:44 +1300

netty (1:4.1.48-8) unstable; urgency=medium

  * Team upload.
  * Fix CVE-2023-34462: (Closes: #1038947)
    Guard against high memory usage when parsing ClientHello messages.
  * Fix CVE-2023-44487: (Closes: #1054234)
    The HTTP/2 protocol allows a denial of service (server resource
    consumption) because request cancellation can reset many streams quickly.

 -- Markus Koschany <apo@debian.org>  Sun, 05 Nov 2023 21:07:13 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libnetty-common-java`.
