Netty Files

Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in https://github.com/netty/netty/pull/17221
• Update setup-testlens to v1.9.4 by @marcphilipp in https://github.com/netty/netty/pull/17223
• Update lz4-java to 1.11.2 by @yawkat in https://github.com/netty/netty/pull/17222
• Validate chunked-must-be-last regardless of HTTP version by @husseinvr97 in https://github.com/netty/netty/pull/17055
• Add system property to disable RFC 6761 localhost resolution by @BoxJReilly in https://github.com/netty/netty/pull/17100
• Use VarHandle JCTools queues without Unsafe by @arnabnandy7 in https://github.com/netty/netty/pull/17185
• Adjust failsafe plugin version to be in sync with surefire plugin by @normanmaurer in https://github.com/netty/netty/pull/17236
• Fix NPE in AbstractNioChannel.removeReadOp() after concurrent deregistration by @seonwooj0810 in https://github.com/netty/netty/pull/17104
• Fix codec-native-quic published POM packaging by @arnabnandy7 in https://github.com/netty/netty/pull/17235
• http3: marshal QPACK resume/drain to stream event loop (fixes [#17234]) by @arnabnandy7 in https://github.com/netty/netty/pull/17232
• Release unsent LastHttpContent in HttpChunkedInput by @Gimini-3 in https://github.com/netty/netty/pull/17240
• Ensure OCSP is also tested with out native implementation by @normanmaurer in https://github.com/netty/netty/pull/17220
• QUIC: Delete local references as soon as possible in the JNI layer by @normanmaurer in https://github.com/netty/netty/pull/17258
• Decouple QUIC token validation from ODCID derivation by @Zhengcy05 in https://github.com/netty/netty/pull/17035
• HTTP/2: Release compressors after failed headers writes by @Gimini-3 in https://github.com/netty/netty/pull/17253
• HTTP/2: Prevent reentrant flush on writability change by @arnabnandy7 in https://github.com/netty/netty/pull/17266
• Respect max messages per read in LocalServerChannel by @Gimini-3 in https://github.com/netty/netty/pull/17255
• Bzip2: Correctly detect overflow during block size bound check by @normanmaurer in https://github.com/netty/netty/pull/17261
• HTTP: Preserve encoder state after header encoding failures by @Gimini-3 in https://github.com/netty/netty/pull/17271
• HTTP/2: Drain queued frames stranded by a writability change during flush by @bryce-anderson in https://github.com/netty/netty/pull/17279
• OSCP: Add clock skew tolerance to OcspServerCertificateValidator by @chrisvest in https://github.com/netty/netty/pull/17277
• Release channel when FixedChannelPool acquire is cancelled by @Gimini-3 in https://github.com/netty/netty/pull/17287
• HTTP: Release content encoder after header mutation failure by @Gimini-3 in https://github.com/netty/netty/pull/17292
• Correctly mark org.jctools:jctools-core-jdk11 as non optional by @normanmaurer in https://github.com/netty/netty/pull/17263
• Update flatten plugin and use flattenDependecyMode direct by @normanmaurer in https://github.com/netty/netty/pull/17296
• Add a script that can download GHSA vulnerability reports by @chrisvest in https://github.com/netty/netty/pull/17297
• FileRegion: Remove outdated JDK upgrade warning by @arnabnandy7 in https://github.com/netty/netty/pull/17308
• codec-dns: Fix query OPCODE bit offset and mask by @hyperxpro in https://github.com/netty/netty/pull/17314
• POOL: Close active unhealthy channels on release by @Gimini-3 in https://github.com/netty/netty/pull/17306
• QPACK: Correctly encode varint even when remainder is 128 by @normanmaurer in https://github.com/netty/netty/pull/17310
• Install patchelf as part of awslc docker image generation by @normanmaurer in https://github.com/netty/netty/pull/17317
• Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @normanmaurer in https://github.com/netty/netty/pull/17313
• codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @hyperxpro in https://github.com/netty/netty/pull/17325
• Protobuf: Update protobuf-javanano to non alpha release by @normanmaurer in https://github.com/netty/netty/pull/17330
• Port EOF handling test by @normanmaurer in https://github.com/netty/netty/pull/17336
• Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @dometec in https://github.com/netty/netty/pull/17105
• io_uring: do not release write memory that the kernel still owns by @HwangRock in https://github.com/netty/netty/pull/17238
• DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @normanmaurer in https://github.com/netty/netty/pull/17343
• Auto-port 4.2: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17344
• Close Channel when connect is cancelled during resolution by @Gimini-3 in https://github.com/netty/netty/pull/17321
• Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @rajan-github in https://github.com/netty/netty/pull/17340
• Http2: Cleanup child channel method signatures by @normanmaurer in https://github.com/netty/netty/pull/17350
• QPACK: Only call firstByteEquals(...) when we actually have readables bytes in decodeLiteralValue(...) by @normanmaurer in https://github.com/netty/netty/pull/17352
• Update to latest netty-tcnative release by @normanmaurer in https://github.com/netty/netty/pull/17359
• Update to latest netty-jni-util release by @normanmaurer in https://github.com/netty/netty/pull/17363
• Make the Linux codec-native-quic artifacts loadable on musl (Alpine) by @fredericgermain in https://github.com/netty/netty/pull/17348
• ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @panchenko in https://github.com/netty/netty/pull/17357
• IoUring: Expose tcp_info by @normanmaurer in https://github.com/netty/netty/pull/17354
• Auto-port 4.2: Fix JdkZlibDecoder silently truncating highly compressible streams by @netty-project-bot in https://github.com/netty/netty/pull/17370
• Add missing EOF handling test for io_uring by @normanmaurer in https://github.com/netty/netty/pull/17374
• QUIC: Add missing NULL checks in native code to handle gracefully OOM by @normanmaurer in https://github.com/netty/netty/pull/17378
• Fix JZlibDecoder truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17392
• Fix typos in comments/javadoc by @TianHengZhuang in https://github.com/netty/netty/pull/17390
• Update to latest netty tcnative version by @normanmaurer in https://github.com/netty/netty/pull/17395
• Update quiche to 0.29.2 by @normanmaurer in https://github.com/netty/netty/pull/17393
• Bulk merge for 4.2 by @normanmaurer in https://github.com/netty/netty/pull/17402

New Contributors

• @marcphilipp made their first contribution in https://github.com/netty/netty/pull/17223
• @BoxJReilly made their first contribution in https://github.com/netty/netty/pull/17100
• @arnabnandy7 made their first contribution in https://github.com/netty/netty/pull/17185
• @Gimini-3 made their first contribution in https://github.com/netty/netty/pull/17240
• @Zhengcy05 made their first contribution in https://github.com/netty/netty/pull/17035
• @dometec made their first contribution in https://github.com/netty/netty/pull/17105
• @fredericgermain made their first contribution in https://github.com/netty/netty/pull/17348
• @panchenko made their first contribution in https://github.com/netty/netty/pull/17357
• @TianHengZhuang made their first contribution in https://github.com/netty/netty/pull/17390

Full Changelog: https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final