Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/netty@1:4.1.48-8?distro=trixie
purl pkg:deb/debian/netty@1:4.1.48-8?distro=trixie
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-5781-s1ny-q7ey CVE-2023-44487
GHSA-2m7v-gc89-fjqf
GHSA-qppj-fm5r-hxr3
GHSA-vx74-f528-fxqg
GHSA-xpw8-rcwv-8f8p
GMS-2023-3377
VSV00013
VCID-8b9g-6r2j-tqhw Allocation of Resources Without Limits or Throttling Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final. CVE-2023-34462
GHSA-6mjq-h674-j845

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T11:08:17.843029+00:00 Debian Importer Fixing VCID-5781-s1ny-q7ey https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-16T09:16:55.488737+00:00 Debian Importer Fixing VCID-8b9g-6r2j-tqhw https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-13T07:34:06.522561+00:00 Debian Importer Fixing VCID-5781-s1ny-q7ey https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-11T18:12:09.971988+00:00 Debian Importer Fixing VCID-8b9g-6r2j-tqhw https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-03T07:46:53.868410+00:00 Debian Importer Fixing VCID-5781-s1ny-q7ey https://security-tracker.debian.org/tracker/data/json 38.1.0
2026-04-03T07:46:53.818397+00:00 Debian Importer Fixing VCID-8b9g-6r2j-tqhw https://security-tracker.debian.org/tracker/data/json 38.1.0