netty (1:4.1.48-16) [PTS] [DDPO]

NEW: VCS has unreleased changes: 1:4.1.48-17 > 1:4.1.48-16

Git: https://salsa.debian.org/java-team/netty.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 81068032
Browser: https://salsa.debian.org/java-team/netty
Last scan: 2026-08-07 09:59:04+00
Error: https://salsa.debian.org/api/v4/projects/java-team%2Fnetty API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
Next scan: 2026-08-13 02:15:00+00

Debian changelog in Git:

netty (1:4.1.48-17) unstable; urgency=medium

  * Team upload
  * Fix a performance regression for CVE-2025-58057
    A recent change changed JdkZlibDecoder to fire
    ctx.fireChannelRead() on every inflate iteration (~8KB output) when
    maxAllocation is 0. For a typical ~150KB HTTP response this produces
    ~19 small buffer allocations and ~19 pipeline dispatches through the
    internal EmbeddedChannel used by HttpContentDecoder, causing a 30-35%
    throughput regression even in aggregated mode (where chunk count is
    irrelevant downstream).
  * Fix CVE-2026-33871 (Closes: #1132230):
    a remote user can trigger a Denial of Service (DoS) against a Netty
    HTTP/2 server by sending a flood of `CONTINUATION` frames. The
    server's lack of a limit on the number of `CONTINUATION` frames,
    combined with a bypass of existing size-based mitigations using
    zero-byte frames, allows an user to cause excessive CPU consumption
    with minimal bandwidth, rendering the server unresponsive
  * Fix CVE-2026-33870 (Closes: #1132229):
    netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer
    encoding extension values, enabling request smuggling attacks.

 -- Bastien Roucariès <rouca@debian.org>  Mon, 06 Apr 2026 15:55:51 +0200

This branch is 4 commits ahead of tag debian/1%4.1.48-16

Git log:

commit c549add863392de1c30e8ac7c81d34364fcdd834
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Apr 6 17:40:35 2026 +0200

    Fix ByteBuf type

commit 0c4fc7e4b9c921ecb9dde2a75b7c8a16efbe3dde
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Apr 6 17:15:53 2026 +0200

    Fix a typo

commit 8c4e14cce4f6c750cda0eb657d108ce822d4437a
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Apr 6 16:46:55 2026 +0200

    CVE-2026-33870

commit 1a58ead93eabf86495195fca2eab568833093aa3
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Apr 6 15:56:24 2026 +0200

    CVE-2026-33871