USN-8654-1: Netty vulnerabilities

Publication date

20 August 2026

Overview

Netty could be made to crash or expose sensitive information if it received specially crafted network traffic.


Packages

  • netty - event-driven asynchronous network application framework

Details

It was discovered that Netty did not properly handle malformed HTTP/2
control frames. An attacker could use this to cause a denial of service
via resource exhaustion. This issue only affects Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-55163)

It was discovered that Netty did not properly validate the request URI
for line-break characters. An attacker could use this to perform CRLF
injection and request smuggling. (CVE-2025-67735)

It was discovered that Netty did not properly handle malformed HTTP/2
control frames. An attacker could use this to cause a denial of service
via resource exhaustion. This issue only affects Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-55163)

It was discovered that Netty did not properly validate the request URI
for line-break characters. An attacker could use this to perform CRLF
injection and request smuggling. (CVE-2025-67735)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04 LTS noble libnetty-java –  1:4.1.48-9ubuntu0.2
22.04 LTS jammy libnetty-java –  1:4.1.48-4+deb11u2ubuntu0.2
20.04 LTS focal libnetty-java –  1:4.1.45-1ubuntu0.1~esm7  
18.04 LTS bionic libnetty-java –  1:4.1.7-4ubuntu0.1+esm7  
16.04 LTS xenial libnetty-java –  1:4.0.34-1ubuntu0.1~esm5

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›