netty (1:4.1.48-4+deb11u2ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 MadeYouReset denial of service
    - debian/patches/CVE-2025-55163_before-1.patch: Only enable RST frame
      limiting for servers by default.
    - debian/patches/CVE-2025-55163_1.patch: Use Http2ConnectionEncoder
      instead of frameWriter when writing RST streams.
    - debian/patches/CVE-2025-55163_2.patch: Enforce a maximum number of RST
      frames sent per time window.
    - CVE-2025-55163
  * SECURITY UPDATE: CRLF injection / request smuggling in HttpRequestEncoder
    - debian/patches/CVE-2025-67735.patch: Add validateRequestLineTokens and
      isEncodingSafeStartLineToken checks.
    - CVE-2025-67735

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Wed, 12 Aug 2026 19:44:19 +0000

netty (1:4.1.48-4+deb11u2ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-58057.patch: Adjust how decoders and
      decompressors manage buffers to prevent out-of-memory in
      .../http/HttpContentDecoder.java,
      .../http2/DelegatingDecompressorFrameListener.java,
      .../compression/JZlibDecoder.java, .../compression/JdkZlibDecoder.java,
      and add tests to .../http/HttpContentDecompressorTest.java and
      .../compression/{AbstractIntegrationTest.java,
      JZlibIntegrationTest.java, JdkZlibIntegrationTest.java}.
    - CVE-2025-58057
  * SECURITY UPDATE: HTTP request/response smuggling
    - debian/patches/CVE-2025-58056.patch: Enforce stricter parsing of line
      endings in .../http/{HttpObjectDecoder.java, HttpRequestDecoder.java,
      HttpResponseDecoder.java, InvalidChunkExtensionException.java,
      InvalidChunkTerminationException.java,
      InvalidLineSeparatorException.java} and add tests to
      .../http/{HttpRequestDecoderTest.java, HttpResponseDecoderTest.java}.
    - CVE-2025-58056

 -- Edwin Jiang <edwin.jiang@canonical.com>  Thu, 27 Nov 2025 20:44:42 +0000

netty (1:4.1.48-4+deb11u2build0.22.04.1) jammy-security; urgency=medium

  * fake sync from Debian

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Thu, 29 Aug 2024 13:27:19 -0300

netty (1:4.1.48-4+deb11u2) bullseye-security; urgency=high

  * Team upload.
  * Fix CVE-2023-34462: (Closes: #1038947)
    Guard against high memory usage when parsing ClientHello messages.
  * Fix CVE-2023-44487: (Closes: #1054234)
    The HTTP/2 protocol allows a denial of service (server resource
    consumption) because request cancellation can reset many streams quickly.
  * Add 21-java-17.patch to fix a FTBFS with newer OpenJDK versions.

 -- Markus Koschany <apo@debian.org>  Sat, 18 Nov 2023 15:32:05 +0100

netty (1:4.1.48-4+deb11u1) bullseye-security; urgency=high

  * Team upload.
  * Fix CVE-2021-37136, CVE-2021-37137, CVE-2021-43797, CVE-2022-41881,
    and CVE-2022-41915. Several out-of-memory, stack overflow or HTTP request
    smuggling vulnerabilities have been discovered in Netty which may allow
    attackers to cause a denial of service or bypass restrictions when used as
    a proxy. (Closes: #1027180, #1014769, #1001437)

 -- Markus Koschany <apo@debian.org>  Sun, 01 Jan 2023 19:17:21 +0100

netty (1:4.1.48-4) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-21409 (Closes: #986217)
    Address a vulnerability that enables request smuggling. The content-length
    header is not correctly validated if the request only uses a single
    Http2HeaderFrame with the endStream set to true. This could lead to request
    smuggling if the request is proxied to a remote peer and translated to
    HTTP/1.1.  This is a followup to CVE-2021-21295 to address this case.

 -- tony mancill <tmancill@debian.org>  Wed, 31 Mar 2021 22:01:52 -0700

netty (1:4.1.48-3) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-21295:
    There is a vulnerability that enables request smuggling. If a
    Content-Length header is present in the original HTTP/2 request, the field
    is not validated by `Http2MultiplexHandler` as it is propagated up. This is
    fine as long as the request is not proxied through as HTTP/1.1. If the
    request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1
    domain objects (`HttpRequest`, `HttpContent`, etc.) via
    `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's
    pipeline and proxied through a remote peer as HTTP/1.1 this may result in
    request smuggling. (Closes: #984948)

 -- Markus Koschany <apo@debian.org>  Fri, 26 Mar 2021 13:37:15 +0100

netty (1:4.1.48-2) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-21290:
    In Netty there is a vulnerability on Unix-like systems involving an
    insecure temp file. When netty's multipart decoders are used local
    information disclosure can occur via the local system temporary directory
    if temporary storing uploads on the disk is enabled. On unix-like systems,
    the temporary directory is shared between all user. As such, writing to
    this directory using APIs that do not explicitly set the file/directory
    permissions can lead to information disclosure. Thanks to Salvatore
    Bonaccorso for the report. (Closes: #982580)
  * Switch to debhelper-compat = 13.
  * Declare compliance with Debian Policy 4.5.1.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Feb 2021 00:17:55 +0100

netty (1:4.1.48-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 06 Apr 2020 00:17:03 +0200

netty (1:4.1.45-2) unstable; urgency=medium

  * Team upload.
  * Enable building of transport-native-kqueue.
    - Needed to update async-http-client.

 -- Sudip Mukherjee <sudipm.mukherjee@gmail.com>  Fri, 20 Mar 2020 16:35:51 +0000

# For older changelog entries, run 'apt-get changelog libnetty-java'
