Skip to content
OpenAdvisories
High 1 exploited CVE DSA-5558-1 2 CVEs

netty - security update

Published Nov 18, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 11 netty 1:4.1.48-4+deb11u2
Debian · 12 netty 1:4.1.48-7+deb12u1

Vulnerabilities 2

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • Medium 6.5
    CVE-2023-34462

    netty-handler SniHandler 16MB allocation

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

    netty netty netty netty Debian Ubuntu Wolfi Maven