Bump nettyVersion from 4.2.7.Final to 4.2.15.Final by dependabot[bot] · Pull Request #9140 · odpi/egeria

dependabot · 2026-07-01T03:03:37Z

Bumps nettyVersion from 4.2.7.Final to 4.2.15.Final.
Updates io.netty:netty-handler from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-50560: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-common from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-common's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-50560: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-buffer from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-buffer's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-50560: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-50560: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-all from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-all's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-50560: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-transport from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-transport's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-50560: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-resolver from 4.2.7.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-resolver's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

Bumps `nettyVersion` from 4.2.7.Final to 4.2.15.Final. Updates `io.netty:netty-handler` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) Updates `io.netty:netty-common` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) Updates `io.netty:netty-buffer` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) Updates `io.netty:netty-all` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) Updates `io.netty:netty-transport` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver` from 4.2.7.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.7.Final...netty-4.2.15.Final) --- updated-dependencies: - dependency-name: io.netty:netty-handler dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-common dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-buffer dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-all dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-resolver dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Jul 1, 2026

dependabot Bot requested a review from mandy-chessell as a code owner July 1, 2026 03:03

dependabot Bot added java Pull requests that update Java code dependencies Pull requests that update a dependency file labels Jul 1, 2026

dependabot Bot mentioned this pull request Jul 1, 2026

Bump nettyVersion from 4.2.7.Final to 4.2.14.Final #9085

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump nettyVersion from 4.2.7.Final to 4.2.15.Final#9140

Bump nettyVersion from 4.2.7.Final to 4.2.15.Final#9140
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/nettyVersion-4.2.15.Final

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants