Netty - Browse /netty-4.2.19.Final at SourceForge.net

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
netty-4.2.19.Final source code.tar.gz	2026-10-06	4.2 MB	0
netty-4.2.19.Final source code.zip	2026-10-06	8.2 MB	0
README.md	2026-10-06	16.1 kB	0
Totals: 3 Items		12.4 MB	0

Security

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
CVE-2026-XXXXX : improper access control in io.netty:netty-handler
CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

What's Changed

perf: Use LinkedHashSet to deduplicate search domains by @JunggiKim in https://github.com/netty/netty/pull/17400
Handle non-positive skip lengths in ByteBufInputStream by @cuishuang in https://github.com/netty/netty/pull/17388
Avoid double promise allocation in SslHandler.wrap() by @doom369 in https://github.com/netty/netty/pull/17382
Socket: Add half-closure tests to SocketHalfClosedTest by @rajan-github in https://github.com/netty/netty/pull/17394
HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @hunseonglee in https://github.com/netty/netty/pull/17386
codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @hyperxpro in https://github.com/netty/netty/pull/17373
transport: Avoid io_uring completion callback allocation by @massiccio in https://github.com/netty/netty/pull/17457
QUIC: Ensure writable events reflect stream capacity by @yawkat in https://github.com/netty/netty/pull/17431
OcspServerCertificateValidatorTest: Fix possible leak in test by @normanmaurer in https://github.com/netty/netty/pull/17469
Use github to download cmake and also remove tar file after unpacking by @normanmaurer in https://github.com/netty/netty/pull/17482
build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @normanmaurer in https://github.com/netty/netty/pull/17484
HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @ohchanKyu in https://github.com/netty/netty/pull/17456
Fix buffer leak when recvmmsg returns single UDP_GRO batch by @octa-one in https://github.com/netty/netty/pull/17493
Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @fudianchn in https://github.com/netty/netty/pull/17438
Add regression test for close() cascade reentering flush() by @normanmaurer in https://github.com/netty/netty/pull/17497
Fix UDP_GRO segment size is lost when reading with recvmmsg by @octa-one in https://github.com/netty/netty/pull/17492
KQueueDatagramChannel: rewrite IPv4-wildcard bind to IPv6-any on dual-stack sockets by @normanmaurer in https://github.com/netty/netty/pull/17498
Make CompositeBufferGatheringWriteTest robust against write/close race by @normanmaurer in https://github.com/netty/netty/pull/17508
Add option to ignore MaxDirectMemorySize JVM argument by @franz1981 in https://github.com/netty/netty/pull/17177
Only build affected Maven modules for PR verification by @normanmaurer in https://github.com/netty/netty/pull/17512
Add workflow that will cancel running workflows for merged PRs by @normanmaurer in https://github.com/netty/netty/pull/17518
Harden DnsNameResolverTest against transient null localAddress from TestDnsServer by @normanmaurer in https://github.com/netty/netty/pull/17514
Fix flaky memory leak detection in OcspServerCertificateValidatorTest by @normanmaurer in https://github.com/netty/netty/pull/17524
Cache docker build images in ghcr.io to speed up CI by @normanmaurer in https://github.com/netty/netty/pull/17530
HTTP/2: Remove failed SETTINGS from ACK queue by @Gimini-3 in https://github.com/netty/netty/pull/17387
Fix compilation on latest macOS 27.0 by @normanmaurer in https://github.com/netty/netty/pull/17529
Make IoEventLoopGroup.isCompatible/isIoType side-effect free by @idelpivnitskiy in https://github.com/netty/netty/pull/17544
Fix flaky memory leak detection in OcspServerCertificateValidatorTest by @normanmaurer in https://github.com/netty/netty/pull/17536
Reset busy counters after triggering an auto-scale-up decision by @normanmaurer in https://github.com/netty/netty/pull/17538
Http2ConnectionRoundtripTest: Reduce timing sensitivity to fix CI flakiness by @normanmaurer in https://github.com/netty/netty/pull/17540
ProtobufVarint32FrameDecoder must wait for more data when the length prefix is incomplete by @ohchanKyu in https://github.com/netty/netty/pull/17550
QpackEncoder.sectionAcknowledgment must not NPE when dynamic table is disabled by @normanmaurer in https://github.com/netty/netty/pull/17537
Fix missing readable-bytes check in SmtpResponseDecoder by @normanmaurer in https://github.com/netty/netty/pull/17516
Guard against out-of-bounds reads when parsing ClientHello SNI extension by @normanmaurer in https://github.com/netty/netty/pull/17532
Fix IndexOutOfBoundsException from mismatched varint length in Http3FrameCodec by @normanmaurer in https://github.com/netty/netty/pull/17523
Fix missing readable-bytes checks in QuicHeaderParser by @normanmaurer in https://github.com/netty/netty/pull/17515
Http2: Reserve promised stream before running the request verifier by @normanmaurer in https://github.com/netty/netty/pull/17495
Fix HTTP/3 decoding of frames with zero length payloads by @violetagg in https://github.com/netty/netty/pull/17564
DnsAddressResolverGroupTest: Use a mock DNS server instead of resolving netty.io over the network by @normanmaurer in https://github.com/netty/netty/pull/17566
Use random generated LocalAddress in tests that use local transport by @normanmaurer in https://github.com/netty/netty/pull/17570
POOL: Release Channel when SimpleChannelPool acquire is cancelled by @renechoi in https://github.com/netty/netty/pull/17569
Fix missing per-entry clamp in IoUringBufferRing.useBuffer by @normanmaurer in https://github.com/netty/netty/pull/17568
Reject incomplete PUSH_PROMISE request headers when validateRequiredPseudoHeaders is enabled by @normanmaurer in https://github.com/netty/netty/pull/17460
Add regression tests for CANCEL_PUSH/GOAWAY/MAX_PUSH_ID trailing bytes by @normanmaurer in https://github.com/netty/netty/pull/17571
Use 2 EventLoops when running our tests by default by @normanmaurer in https://github.com/netty/netty/pull/17567
Fix flaky HttpToHttp2ConnectionHandlerTest.testChunkedRequestWithBodyAndTrailingHeaders by @normanmaurer in https://github.com/netty/netty/pull/17590
Http2ConnectionHandler: report at most one stream error for a CompositeStreamException by @normanmaurer in https://github.com/netty/netty/pull/17470
Http2MultiplexTransportTest: Fix possible SslContext leak in tests by @normanmaurer in https://github.com/netty/netty/pull/17597
Restore configurable ioRatio-based task scheduling in SingleThreadIoEventLoop by @normanmaurer in https://github.com/netty/netty/pull/17481
Support creating a PropertyKey that is not tied to a specific Http2Connection by @normanmaurer in https://github.com/netty/netty/pull/17594
Reset LengthFieldBasedFrameDecoder state when the frame is shorter than initialBytesToStrip by @allthingssecurity in https://github.com/netty/netty/pull/17606
Auto-port 4.2: SingleThreadEventExecutor: fix race between suspend and cancellation … by @netty-project-bot in https://github.com/netty/netty/pull/17601
Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the buffer's own internal NIO buffer by @laosijikaichele in https://github.com/netty/netty/pull/17618
Add missing bounds check to AdaptiveByteBuf.getBytes(...) channel variants by @laosijikaichele in https://github.com/netty/netty/pull/17620
SingleThreadEventExecutor: fix remaining suspend/cancellation race by @normanmaurer in https://github.com/netty/netty/pull/17627
Update lz4-java to 1.12.0 by @yawkat in https://github.com/netty/netty/pull/17631
Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE overflow issue by @skyguard1 in https://github.com/netty/netty/pull/17602
HTTP/2: Fix stream stall when toggling auto-read on a child channel by @pandareen in https://github.com/netty/netty/pull/17617
Run the Linux test legs on ubuntu-24.04 so io_uring buffer ring tests execute by @franz1981 in https://github.com/netty/netty/pull/17637
Update quiche to a new version 0.30.0 by @sanjomo in https://github.com/netty/netty/pull/17642
No need to call clear() on ByteBuffer after AdaptiveByteBuf.internalNioBuffer() by @laosijikaichele in https://github.com/netty/netty/pull/17619
Don't strand tasks when trySuspend() races with startThread() by @allthingssecurity in https://github.com/netty/netty/pull/17608
Use assertInstanceOf/assertThrows instead of assertTrue/fail idioms in tests by @normanmaurer in https://github.com/netty/netty/pull/17633
PendingWriteQueue: unlink the write before failing it in removeAndFail by @allthingssecurity in https://github.com/netty/netty/pull/17657
Don't lose HashedWheelTimer timeouts that race with stop() by @allthingssecurity in https://github.com/netty/netty/pull/17610
Don't corrupt the pipeline when a handler context is removed twice by @allthingssecurity in https://github.com/netty/netty/pull/17643
LocalChannel: complete connect() when the accepted channel dies before registration by @allthingssecurity in https://github.com/netty/netty/pull/17656
Don't leak FixedChannelPool slots on unrelated IllegalArgumentException by @allthingssecurity in https://github.com/netty/netty/pull/17609
Don't leak queued writes in ChunkedWriteHandler on removal or cancel by @allthingssecurity in https://github.com/netty/netty/pull/17663
Honour the needle's reader index in ByteBufUtil.indexOf(ByteBuf, ByteBuf) by @allthingssecurity in https://github.com/netty/netty/pull/17682
Close idle outbound HTTP/2 child channels when the parent closes by @allthingssecurity in https://github.com/netty/netty/pull/17679
Only fail in ZlibDecoder when the decompression buffer is full by @allthingssecurity in https://github.com/netty/netty/pull/17692
Fail pending writes of ProxyHandler when it is removed by @allthingssecurity in https://github.com/netty/netty/pull/17691
Use LocalIoHandler instead of DefaultEventLoop for LocalChannel tests in codec-http2 by @normanmaurer in https://github.com/netty/netty/pull/17697
Arm force-close timeout when an inbound CLOSE frame is echoed by @normanmaurer in https://github.com/netty/netty/pull/17574
Don't count STOMP headers again when the header block is replayed by @allthingssecurity in https://github.com/netty/netty/pull/17664
Add script that allows to check if a user has signed the icla by @normanmaurer in https://github.com/netty/netty/pull/17711
Complete HTTP/2 graceful close when the connection closes the last stream by @allthingssecurity in https://github.com/netty/netty/pull/17683
Handle ed25519 and ed448 names in SignatureAlgorithmConverter by @eager-signal in https://github.com/netty/netty/pull/17689
MqttDecoder accepts malformed MQTT 5 property sections and reclassifies payload bytes as properties by @normanmaurer in https://github.com/netty/netty/pull/17714
common: initialize SystemTicker at runtime in native images by @Asthenia0412 in https://github.com/netty/netty/pull/17677
Don't corrupt ChannelOutboundBuffer when a cancelled write makes the channel writable by @allthingssecurity in https://github.com/netty/netty/pull/17702
Fail ChunkedNioFile instead of spinning when the file is shorter than requested by @allthingssecurity in https://github.com/netty/netty/pull/17727
Validate bzip2 Huffman table selector index before use by @normanmaurer in https://github.com/netty/netty/pull/17705
Reset the permessage-deflate compressor after an empty final fragment by @allthingssecurity in https://github.com/netty/netty/pull/17681
Only build and test the affected modules when validating PRs by @normanmaurer in https://github.com/netty/netty/pull/17736
Fix racy DnsNameResolverTest.testNegativeTtl lifecycle observer checks by @normanmaurer in https://github.com/netty/netty/pull/17737
Fix retainedSlice() of non-retained pooled derived buffers by @lhotari in https://github.com/netty/netty/pull/17759
Build using powershell on Windows by @chrisvest in https://github.com/netty/netty/pull/17766
Bulk merge changes for 4.2 by @normanmaurer in https://github.com/netty/netty/pull/17770