Download Latest Version
netty-4.1.136.Final source code.zip (6.6 MB)
Get an email when there's a new version of Netty
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| netty-4.2.15.Final source code.tar.gz | 2026-06-02 | 4.0 MB | |
| netty-4.2.15.Final source code.zip | 2026-06-02 | 7.8 MB | |
| README.md | 2026-06-02 | 4.9 kB | |
| Totals: 3 Items | 11.8 MB | 0 | |
Security fixes
- CVE-2026-48059: memory exhaustion in
io.netty:netty-codec-haproxy(high). - CVE-2026-47691: DNS cache poisoning in
io.netty:netty-resolver-dns(high). - CVE-2026-XXXXX: DDoS in
io.netty:netty-codec-http2. - CVE-2026-XXXXX: memory exhaustion in
io.netty:netty-codec-redis(high). - CVE-2026-44250: memory exhaustion in
io.netty:netty-codec-redis(high). - CVE-2026-44890: memory exhaustion in
io.netty:netty-codec-redis(high). - CVE-2026-XXXXX: information disclosure and denial of service in
io.netty:netty-codec-classes-quic. - CVE-2026-44249: IPv6 subnet filter bypass in
io.netty:netty-handler(high). - CVE-2026-XXXXX: request smuggling in
io.netty:netty-codec-http. - CVE-2026-44892: memory exhaustion in
io.netty:netty-codec-http3(high). - CVE-2026-44893: memory leak in
io.netty:netty-codec-haproxy(high). - CVE-2026-44894: traffic amplification in
io.netty:netty-codec-classes-quic(high). - CVE-2026-XXXXX: TLS hostname verification accidentally disabled in
io.netty:netty-handler(high). - CVE-2026-45673: DNS cache poisoning in
io.netty:netty-resolver-dns. - CVE-2026-45416: excessive memory usage from SNIHandler in
io.netty:netty-handler(high). - CVE-2026-45536: file descriptor leak in
io.netty:netty-transport-native-epollandio.netty:netty-transport-native-kqueue. - CVE-2026-45674: DNS cache poisoning in
io.netty:netty-resolver-dns(high). - CVE-2026-46340: memory exhaustion in
io.netty:netty-transport-sctp(high). - CVE-2026-47244: denial of service in
io.netty:netty-codec-http2. - CVE-2026-48006: memory exhaustion in
io.netty:netty-codec-redis(high). - CVE-2026-48748: memory exhaustion in
io.netty:netty-codec-http3(high). - CVE-2026-48043: memory exhaustion in
io.netty:netty-codec-http2.
What's Changed
- Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in https://github.com/netty/netty/pull/16836
- HTTP/2: Parse request-target path like Vert.x by @yawkat in https://github.com/netty/netty/pull/16810
- Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in https://github.com/netty/netty/pull/16853
- FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in https://github.com/netty/netty/pull/16837
- Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in https://github.com/netty/netty/pull/16844
- Fix revapi warnings by @chrisvest in https://github.com/netty/netty/pull/16885
- Fix SCTP and Redis tests by @chrisvest in https://github.com/netty/netty/pull/16893
- Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in https://github.com/netty/netty/pull/16850
- Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in https://github.com/netty/netty/pull/16890
New Contributors
- @schiemon made their first contribution in https://github.com/netty/netty/pull/16837
- @fedinskiy made their first contribution in https://github.com/netty/netty/pull/16844
Full Changelog: https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final
