[GHSA-prj3-ccx8-p6x4] Netty affected by MadeYouReset HTTP/2 DDoS vulnerability

[coheigea]

Updates

• Affected products
• CVSS v3

Comments
The version 1.175.0 is incorrect for io.grpc:grpc-netty-shaded, there is no such version on https://mvnrepository.com/artifact/io.grpc/grpc-netty-shaded. The change was done grpc/grpc-java@6462ef9 and released in version 1.75.0 (https://github.com/grpc/grpc-java/releases/tag/v1.75.0)

[github]

Hi there @normanmaurer! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull Request Overview

This PR fixes a security advisory for the Netty MadeYouReset HTTP/2 DDoS vulnerability by correcting an incorrect version number and updating CVSS scoring information.

• Corrects the fixed version for io.grpc:grpc-netty-shaded from "1.175.0" to "1.75.0"
• Removes the CVSS v3 scoring section, keeping only CVSS v4
• Updates the modification timestamp

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[shelbyc]

Closed as a duplicate of #6228