netty (1:4.1.45-1ubuntu0.1~esm7) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 MadeYouReset denial of service
    - debian/patches/CVE-2025-55163_before-1.patch: Only enable RST frame
      limiting for servers by default.
    - debian/patches/CVE-2025-55163_1.patch: Use Http2ConnectionEncoder
      instead of frameWriter when writing RST streams.
    - debian/patches/CVE-2025-55163_2.patch: Enforce a maximum number of RST
      frames sent per time window.
    - CVE-2025-55163
  * SECURITY UPDATE: CRLF injection / request smuggling in HttpRequestEncoder
    - debian/patches/CVE-2025-67735.patch: Add validateRequestLineTokens and
      isEncodingSafeStartLineToken checks.
    - CVE-2025-67735

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Wed, 12 Aug 2026 19:44:19 +0000

netty (1:4.1.45-1ubuntu0.1~esm6) focal-security; urgency=medium

  * SECURITY UPDATE: Improper Neutralization of CRLF Sequences in HTTP Headers
    - debian/patches/CVE-2026-42578_1.patch: Validate headers by default in
      handler-proxy/.../HttpProxyHandler.java. Add test in
      handler-proxy/.../HttpProxyHandlerTest.java.
    - debian/patches/CVE-2026-42578_2.patch: Re-add constructor to
      HttpProxyHandler that was removed by mistake in
      handler-proxy/.../HttpProxyHandler.java.
    - CVE-2026-42578
  * SECURITY UPDATE: Improper Input Validation 
    - debian/patches/CVE-2026-42579_1.patch: Validate token length and domain
      name length in codec-dns/.../DnsCodecUtil.java,
      codec-dns/.../DnsCodecUtilTest.java.
    - debian/patches/CVE-2026-42579_2.patch: Fix codec-dns tests in
      codec-dns/.../DnsCodecUtil.java, codec-dns/.../DnsCodecUtilTest.java.
    - CVE-2026-42579
  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2026-42581.patch: Throw error if decoding an HTTP/1.0
      message with both Transfer-Encoding and Content-Length in
      codec-http/.../ContentLengthNotAllowedException.java,
      codec-http/.../HttpObjectDecoder.java,
      codec-http/.../HttpRequestDecoder.java,
      codec-http/.../HttpResponseDecoder.java,
      codec-http/.../HttpServerCodec.java,
      codec-http/.../TransferEncodingNotAllowedException.java,
      codec-http/.../HttpInvalidMessageTest.java,
      codec-http/.../HttpRequestDecoderTest.java,
      codec-http/.../HttpResponseDecoderTest.java,
      codec-http/.../HttpServerCodecTest.java,
      codec-http/.../HttpServerKeepAliveHandlerTest.java.
    - CVE-2026-42581
  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2026-42584.patch: Fix request/response pairing in
      codec-http/.../HttpClientCodec.java. Add test in
      codec-http/.../HttpClientCodecTest.java.
    - CVE-2026-42584
  * SECURITY UPDATE: HTTP Request Smuggling
    - debian/patches/CVE-2026-42585-1.patch: Validate that chunked is the last
      encoding in codec-http/.../HttpObjectDecoder.java. Add test in
      codec-http/.../HttpRequestDecoderTest.java.
    - debian/patches/CVE-2026-42585-2.patch: Fix checkstyle in
      codec-http/.../HttpObjectDecoder.java.
    - CVE-2026-42585
  * SECURITY UPDATE: CRLF Injection
    - debian/patches/CVE-2026-42586.patch: Reject messages with CR or LF in
      codec-redis/.../RedisEncoder.java.
    - CVE-2026-42586

 -- Edwin Jiang <edwin.jiang@canonical.com>  Wed, 03 Jun 2026 16:58:56 -0400

netty (1:4.1.45-1ubuntu0.1~esm4) focal-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-58057.patch: Adjust how decoders and
      decompressors manage buffers to prevent out-of-memory in
      .../http/HttpContentDecoder.java,
      .../http2/DelegatingDecompressorFrameListener.java,
      .../compression/JZlibDecoder.java, .../compression/JdkZlibDecoder.java,
      and add tests to .../http/HttpContentDecompressorTest.java and
      .../compression/{AbstractIntegrationTest.java,
      JZlibIntegrationTest.java, JdkZlibIntegrationTest.java}.
    - CVE-2025-58057
  * SECURITY UPDATE: HTTP request/response smuggling
    - debian/patches/CVE-2025-58056.patch: Enforce stricter parsing of line
      endings in .../http/{HttpObjectDecoder.java, HttpRequestDecoder.java,
      HttpResponseDecoder.java, InvalidChunkExtensionException.java,
      InvalidChunkTerminationException.java,
      InvalidLineSeparatorException.java}, 
      .../internal/AppendableCharSequence.java and add tests to
      .../http/{HttpRequestDecoderTest.java, HttpResponseDecoderTest.java}.
    - CVE-2025-58056

 -- Edwin Jiang <edwin.jiang@canonical.com>  Thu, 27 Nov 2025 21:03:09 +0000

netty (1:4.1.45-1ubuntu0.1~esm3) focal-security; urgency=medium

  * SECURITY UPDATE: email forgery
    - debian/patches/CVE-2025-59419.patch: prevent SMTP injection
    - CVE-2025-59419

 -- Julia Sarris <julia.sarris@canonical.com>  Thu, 23 Oct 2025 11:50:30 -0400

netty (1:4.1.45-1ubuntu0.1~esm2) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2024-29025.patch: Limit number of fields and
      field size
    - CVE-2024-29025
  * SECURITY UPDATE: Information leak
    - debian/patches/CVE-2022-24823.patch: Add checks for directory
      and permissions
    - debian/patches/remove-deprecated-algorithm.patch: Remove usage
      of sha256WithRSAEncryption_oid
    - CVE-2022-24823

 -- Bruce Cable <bruce.cable@canonical.com>  Fri, 14 Feb 2025 09:00:17 +1100

netty (1:4.1.45-1ubuntu0.1~esm1) focal-security; urgency=medium

  * SECURITY UPDATE: Memory buffer out of bounds
    - debian/patches/CVE-2020-11612.patch: Allow a limit to be set on the
      decompressed buffer size for ZlibDecoders.
    - CVE-2020-11612
  * SECURITY UPDATE: Information disclosure
    - debian/patches/CVE-2021-21290.patch: Use Files.createTempFile to ensure
      files are created with proper permissions.
    - CVE-2021-21290
  * SECURITY UPDATE: HTTP request smuggling
    - debian/patches/CVE-2021-21295.patch: Properly validate content-length
      headers.
    - CVE-2021-21295
  * SECURITY UPDATE: HTTP request smuggling
    - debian/patches/CVE-2021-21409.patch: Properly validate content-length
      headers when a single header with the endStream flag is received.
    - CVE-2021-21409
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2021-37136.patch: Introduce maximum limit for the
      decompressed output data of the Bzip2 decompression decoder function.
    - CVE-2021-37136
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2021-37137.patch: Introduce maximum limit for the
      Snappy frame decoder function.
    - CVE-2021-37137
  * SECURITY UPDATE: HTTP request smuggling
    - debian/patches/CVE-2021-43797.patch: Properly validate and reject
      disallowed control chars at the beginning and end of header names.
    - CVE-2021-43797
  * SECURITY UPDATE: Stack overflow vulnerability
    - debian/patches/CVE-2022-41881.patch: Introduce maximum limit for nesting
      of TLV to avoid infinite recursion on malformed crafted messages.
    - CVE-2022-41881
  * SECURITY UPDATE: HTTP Response Splitting
    - debian/patches/CVE-2022-41915.patch: Add missing header value validation
      for setObject methods that take arrays and iterators as arguments.
    - CVE-2022-41915

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Fri, 21 Apr 2023 21:08:00 +0200

netty (1:4.1.45-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Fixes CVE-2019-20444, CVE-2019-20445 and CVE-2020-7238
      (Closes: #950966, #950967)
    - Refreshed the patches
    - Updated the Maven rules
    - Depend on libnetty-tcnative-java (>= 2.0.28)
    - Disabled the native image support due to missing dependencies
    - Disabled the BlockHound integration
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 17:10:37 +0100

netty (1:4.1.33-3) unstable; urgency=medium

  * Team upload.
  * Apply patch for FTBFS on 32-bit architectures. (Closes: #923455)
    Thank you to Sjoerd Simons for the patch.
  * Set "Rules-Requires-Root: no" in debian/control
  * Specify debhelper compat 12 via debhelper-compat dependency
  * Bump Standards-Version to 4.4.1

 -- tony mancill <tmancill@debian.org>  Wed, 08 Jan 2020 20:40:19 -0800

netty (1:4.1.33-2) unstable; urgency=high

  * Team upload.
  * Correctly handle whitespaces in HTTP header names as defined by
    RFC7230#section-3.2.4 (CVE-2019-16869) (Closes: #941266)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 02 Jan 2020 20:47:57 +0100

netty (1:4.1.33-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Depend on libnetty-tcnative-java (>= 2.0.20)
  * Removed the wrong --has-package-version flag
  * Standards-Version updated to 4.3.0

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 22 Jan 2019 14:06:25 +0100

netty (1:4.1.29-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Depend on libjctools-java (>= 2.0)
    - Depend on libnetty-tcnative-java (>= 2.0)
    - No longer depend on libasm-java
    - Disabled Conscrypt support (missing dependency)
    - Build the new transport-native-unix-common module
    - Install the new Bill of Materials
    - Ignore the new dev-tools, testsuite-autobahn, testsuite-http2,
      testsuite-shading, transport-native-kqueue and
      transport-native-unix-common-tests modules
    - Ignore the forbiddenapis and maven-remote-resources-plugin plugins
    - Removed the Maven wrapper from the upstream tarball
  * Removed the build dependency on libmaven-scm-java and ivy
  * Removed Damien Raude-Morvan from the uploaders (Closes: #889432)
  * Standards-Version updated to 4.2.1
  * Switch to debhelper level 11
  * Use salsa.debian.org Vcs-* URLs
  * Install the NOTICE file as required by the Apache-2.0 license

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 04 Sep 2018 23:41:23 +0200

netty (1:4.1.7-4) unstable; urgency=medium

  * Team upload.
  * Update debian/watch to repack with xz compression
  * Bump Standards-Version to 4.0.0
  * Update jctools2 patch for approach used upstream (see #866771)

 -- tony mancill <tmancill@debian.org>  Sun, 30 Jul 2017 08:31:35 -0700

netty (1:4.1.7-3) unstable; urgency=medium

  * Team upload.
  * Add patch to build against jctools 2.0 (Closes: #866771)
  * Update libjctools-java build-dep to version 2.0

 -- tony mancill <tmancill@debian.org>  Sat, 22 Jul 2017 18:56:07 -0700

netty (1:4.1.7-2) unstable; urgency=medium

  * Team upload.
  * Fixed the netty-all pom (Closes: #852255)

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 23 Jan 2017 09:32:14 +0100

netty (1:4.1.7-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Build the new modules: codec-dns, codec-http2, codec-memcache,
      codec-mqtt, codec-redis, codec-smtp, codec-stomp, handler-proxy,
      resolver-dns and resolver
    - Ignore the new codec-xml module (missing dependency)
    - New dependency: groovy, libcompress-lzf-java, libgoogle-gson-java
    - Adapted codegen.groovy to run without the groovy-maven-plugin
    - Ignore the new test dependencies
    - Disabled lz4, lzma and protobuf nano support due to missing dependencies

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 16 Jan 2017 09:14:21 +0100

netty (1:4.0.42-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
  * Switch to debhelper level 10

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 30 Oct 2016 00:12:28 +0200

netty (1:4.0.41-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Depend on netty-tcnative (>= 1.1.33.Fork21)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 30 Aug 2016 08:52:52 +0200

netty (1:4.0.40-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - New dependency on libjctools-java
    - New build dependency on libmaven-shade-plugin-java
  * Build the netty-transport-native-epoll module
  * Depend on ant-contrib >= 1.0~b3+svn177-8 and dropped the dependency
    on libbcel-java

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 03 Aug 2016 01:04:26 +0200

netty (1:4.0.37-1) unstable; urgency=high

  * Team upload.
  * New upstream release. (Closes: #827620) CVE-2016-4970
  * Add build-dependency on liblog4j2-java.

 -- tony mancill <tmancill@debian.org>  Sat, 18 Jun 2016 14:45:03 -0700

netty (1:4.0.36-2) unstable; urgency=medium

  * Team upload.
  * Removed the empty classifier for the tcnative dependency since it breaks
    the Gradle dependencies resolution

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 24 May 2016 00:45:11 +0200

netty (1:4.0.36-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
  * Depend on libasm-java (>= 5.0) instead of libasm4-java
  * Standards-Version updated to 3.9.8 (no changes)

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 24 Apr 2016 19:20:27 +0200

netty (1:4.0.35-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Updated the Maven rules
  * Standards-Version updated to 3.9.7 (no changes)
  * Use secure Vcs-* fields

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 28 Mar 2016 23:03:36 +0200

netty (1:4.0.34-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Depend on netty-tcnative (>= 1.1.33.Fork11)
  * Build with the DH sequencer instead of CDBS
  * Made the versions.properties embedded in the jar files reproducible

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 31 Jan 2016 23:39:15 +0100

netty (1:4.0.33-1) unstable; urgency=medium

  * Team upload.
  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 19 Nov 2015 23:37:59 +0100

netty (1:4.0.32-1) unstable; urgency=medium

  * Team upload.
  * New upstream release:
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 03 Oct 2015 01:12:58 +0200

netty (1:4.0.31-1) unstable; urgency=medium

  * Team upload.

  [ Emmanuel Bourg ]
  * New upstream release:
    - Build with maven-debian-helper
    - Fixes CVE-2015-2156 (Closes: #796114)
  * debian/control:
    - Team maintenance by Debian Java Maintainers
    - Standards-Version updated to 3.9.6 (no changes)
    - Removed the deprecated DM-Upload-Allowed field
  * debian/watch: Track the release tags on GitHub
  * Moved the package to Git
  * Switch to debhelper level 9

  [ Charles Plessy ]
  * Updated homepage (debian/control).

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 12 Sep 2015 23:26:11 +0200

netty (1:3.2.6.Final-2) unstable; urgency=low

  * Merge from James Page (thanks!):
  * Enable test suite to support Ubuntu MIR (LP: #913878) (Closes: #658250):
    - d/build.xml: Add extra targets to compile and execute unit tests.
    - d/rules: Add testing dependencies to build classpath.
    - d/control: Added junit4 and libeasymock-java to BDI's and ant-optional
      to BD's.
  * d/orig-tar.sh; Dropped - not used.

 -- Damien Raude-Morvan <drazzib@debian.org>  Sun, 12 Feb 2012 12:43:50 +0100

netty (1:3.2.6.Final-1) unstable; urgency=low

  * New upstream release (Closes: #643832):
    - Update watch file for github.
  * Add myself to Uploaders.
  * Use maven-repo-helper to install jar.
  * Bump to Standards-Version to 3.9.2:
    - Provide a get-orig-source target.
    - Drop Depends on default-jre-headless.
    - Drop XSBC-* fields (Ubuntu specific)
    - Add Homepage field.
    - Add Vcs-* fields.
  * Use debhelper 7 compat level.
  * Fix copyright:
    - now under Apache-2.0 licence.
    - update to DEP-5.
  * Switch to 3.0 (quilt) source format.
  * Add Recommends on logging frameworks.

 -- Damien Raude-Morvan <drazzib@debian.org>  Wed, 23 Nov 2011 21:14:19 +0100

netty (1:3.1.0.CR1-1) unstable; urgency=low

  * Port package to pkg-java based largely on existing Ubuntu package
  * Pull sources from svn to build orig tarball avoiding DFSG non-compliance
  * debian/copyright, debian/README.source: Update to reflect DFSG-compliant
    packaging.

 -- Chris Grzegorczyk <grze@eucalyptus.com>  Thu, 17 Dec 2009 03:12:31 -0800

netty (3.1.0.CR1+dfsg-0ubuntu1) karmic; urgency=low

  * Repackaged orig tarball to avoid shipping sourceless doc/ elements.
  * debian/copyright, debian/README.source: Explain repacking.

 -- Thierry Carrez <thierry.carrez@ubuntu.com>  Wed, 26 Aug 2009 15:13:13 +0200

netty (3.1.0.CR1-0ubuntu1) karmic; urgency=low

  * Initial release. New Eucalyptus dependency.

 -- Thierry Carrez <thierry.carrez@ubuntu.com>  Tue, 21 Jul 2009 16:48:12 +0200
