You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Deepin Integration]~[v25-Release] feat: update netty to 1:4.1.48-10+deb13u1 by deepin-community-bot[bot]@deepin-community/netty by deepin-community-ci-bot[bot] #13858
Fix CVE-2025-55163 (Closes: #1111105)
Netty is vulnerable to MadeYouReset DDoS.
This is a logical vulnerability in the HTTP/2 protocol,
that uses malformed HTTP/2 control frames in order to break
the max concurrent streams limit, which results in resource
exhaustion and distributed denial of service.
Fix CVE-2025-58056 (Closes: #1113994)
when supplied with specially crafted input, BrotliDecoder and
certain other decompression decoders will allocate a large
number of reachable byte buffers, which can lead to
denial of service. BrotliDecoder.decompress has
no limit in how often it calls pull, decompressing
data 64K bytes at a time. The buffers are saved in
the output list, and remain reachable until OOM is hit.
Fix CVE-2025-58057:
When supplied with specially crafted input, BrotliDecoder
and certain other decompression decoders will allocate
a large number of reachable byte buffers, which can lead
to denial of service. BrotliDecoder.decompress has no limit
in how often it calls pull, decompressing data 64K bytes at
a time. The buffers are saved in the output list, and remain
reachable until OOM is hit.
(Closes: #1113994)
Fix CVE-2025-59419 (Closes: #1118282)
SMTP Command Injection Vulnerability Allowing Email Forgery
An SMTP Command Injection (CRLF Injection) vulnerability
in Netty's SMTP codec allows a remote attacker who can control
SMTP command parameters (e.g., an email recipient)
to forge arbitrary emails from the trusted server.
This bypasses standard email authentication and can
be used to impersonate executives and forge high-stakes
corporate communications.
Fix CVE-2025-67735 (Closes: #1123606) io.netty.handler.codec.http.HttpRequestEncoder
has a CRLF injection with the request URI when constructing
a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization
of the URI. Any application / framework using HttpRequestEncoder
can be subject to be abused to perform request smuggling using
CRLF injection
Package information | 软件包信息
Package repository address | 软件包仓库地址
Changelog | 更新信息
netty (1:4.1.48-10+deb13u1) trixie-security; urgency=high
Netty is vulnerable to MadeYouReset DDoS.
This is a logical vulnerability in the HTTP/2 protocol,
that uses malformed HTTP/2 control frames in order to break
the max concurrent streams limit, which results in resource
exhaustion and distributed denial of service.
when supplied with specially crafted input, BrotliDecoder and
certain other decompression decoders will allocate a large
number of reachable byte buffers, which can lead to
denial of service. BrotliDecoder.decompress has
no limit in how often it calls pull, decompressing
data 64K bytes at a time. The buffers are saved in
the output list, and remain reachable until OOM is hit.
When supplied with specially crafted input, BrotliDecoder
and certain other decompression decoders will allocate
a large number of reachable byte buffers, which can lead
to denial of service. BrotliDecoder.decompress has no limit
in how often it calls pull, decompressing data 64K bytes at
a time. The buffers are saved in the output list, and remain
reachable until OOM is hit.
(Closes: #1113994)
SMTP Command Injection Vulnerability Allowing Email Forgery
An SMTP Command Injection (CRLF Injection) vulnerability
in Netty's SMTP codec allows a remote attacker who can control
SMTP command parameters (e.g., an email recipient)
to forge arbitrary emails from the trusted server.
This bypasses standard email authentication and can
be used to impersonate executives and forge high-stakes
corporate communications.
io.netty.handler.codec.http.HttpRequestEncoderhas a CRLF injection with the request URI when constructing
a request. This leads to request smuggling when
HttpRequestEncoderis used without proper sanitizationof the URI. Any application / framework using
HttpRequestEncodercan be subject to be abused to perform request smuggling using
CRLF injection