Netty - Browse /netty-4.1.138.Final at SourceForge.net

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
netty-4.1.138.Final source code.tar.gz	2026-09-09	3.4 MB	0
netty-4.1.138.Final source code.zip	2026-09-09	6.6 MB	0
README.md	2026-09-09	9.4 kB	0
Totals: 3 Items		10.0 MB	0

Security fixes

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility note

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by @netty-project-bot in https://github.com/netty/netty/pull/17224
Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by @netty-project-bot in https://github.com/netty/netty/pull/17228
Update junit version by @normanmaurer in https://github.com/netty/netty/pull/17233
Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by @netty-project-bot in https://github.com/netty/netty/pull/17230
Update setup-testlens to v1.9.4 (#17223) by @chrisvest in https://github.com/netty/netty/pull/17229
Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by @netty-project-bot in https://github.com/netty/netty/pull/17241
Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by @netty-project-bot in https://github.com/netty/netty/pull/17251
Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by @netty-project-bot in https://github.com/netty/netty/pull/17265
Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by @netty-project-bot in https://github.com/netty/netty/pull/17268
Respect max messages per read in LocalServerChannel (#17255) by @normanmaurer in https://github.com/netty/netty/pull/17269
Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by @netty-project-bot in https://github.com/netty/netty/pull/17275
Bzip2: Correctly detect overflow during block size bound check (#17261) by @normanmaurer in https://github.com/netty/netty/pull/17273
Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by @netty-project-bot in https://github.com/netty/netty/pull/17280
Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by @normanmaurer in https://github.com/netty/netty/pull/17282
Extract Bootstrap and ServerBootstrap setup to a common method (#15134) by @normanmaurer in https://github.com/netty/netty/pull/17289
Release channel when FixedChannelPool acquire is cancelled (#17287) by @normanmaurer in https://github.com/netty/netty/pull/17291
Auto-port 4.1: HTTP: Release content encoder after header mutation failure by @netty-project-bot in https://github.com/netty/netty/pull/17294
Auto-port 4.1: Add a script that can download GHSA vulnerability reports by @netty-project-bot in https://github.com/netty/netty/pull/17302
Auto-port 4.1: FileRegion: Remove outdated JDK upgrade warning by @netty-project-bot in https://github.com/netty/netty/pull/17311
Auto-port 4.1: codec-dns: Fix query OPCODE bit offset and mask by @netty-project-bot in https://github.com/netty/netty/pull/17316
Auto-port 4.1: Install patchelf as part of awslc docker image generation by @netty-project-bot in https://github.com/netty/netty/pull/17322
Auto-port 4.1: POOL: Close active unhealthy channels on release by @netty-project-bot in https://github.com/netty/netty/pull/17319
Update to use graal 21 by @normanmaurer in https://github.com/netty/netty/pull/17327
Auto-port 4.1: Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @netty-project-bot in https://github.com/netty/netty/pull/17329
Fix graal docker file usage by @normanmaurer in https://github.com/netty/netty/pull/17333
Auto-port 4.1: codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @netty-project-bot in https://github.com/netty/netty/pull/17332
Kqueue: Continue reading when EOF is received before notify about channel inactivity by @normanmaurer in https://github.com/netty/netty/pull/17309
Auto-port 4.1: Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @netty-project-bot in https://github.com/netty/netty/pull/17338
Auto-port 4.1: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17345
Auto-port 4.1: DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @netty-project-bot in https://github.com/netty/netty/pull/17347
Close Channel when connect is cancelled during resolution (#17321) by @normanmaurer in https://github.com/netty/netty/pull/17349
Auto-port 4.1: Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @netty-project-bot in https://github.com/netty/netty/pull/17351
Auto-port 4.1: Http2: Cleanup child channel method signatures by @netty-project-bot in https://github.com/netty/netty/pull/17355
Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/17361
Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in https://github.com/netty/netty/pull/17365
Fix JdkZlibDecoder silently truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17364
Auto-port 4.1: ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @netty-project-bot in https://github.com/netty/netty/pull/17369
Auto-port 4.1: Update to latest netty tcnative version by @netty-project-bot in https://github.com/netty/netty/pull/17398
Bulk merge for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17403