[GHSA-rwm7-x88c-3g2p] Netty epoll transport denial of service via RST on half-closed TCP connection

[SeBBBe]

Updates

• Affected products

Comments
Set a lower bound on the affected version, since the vulnerability only applies to the 4.2 branch as written in the description. This also matches the linked security advisory.

Affected versions

All versions of 4.2.x netty-transport-native-epoll up to and including 4.2.12.Final

[github]

Hi there @chrisvest! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

This PR refines the affected version range for advisory GHSA-rwm7-x88c-3g2p to reflect that the vulnerability applies only to the Netty 4.2 line, aligning the machine-readable range with the advisory text and linked upstream advisory.

Changes:

• Updated the OSV introduced event from "0" to "4.2.0.Final" for io.netty:netty-transport-native-epoll.
• Kept the existing fix boundary at 4.2.13.Final, which implies affected versions through 4.2.12.Final.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[normanmaurer]

This change is correct