netty-4.1.138.Final

Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility note

HTTP/2 header value validation is now enabled by default.
HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now.
Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by @netty-project-bot in #17224
• Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by @netty-project-bot in #17228
• Update junit version by @normanmaurer in #17233
• Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by @netty-project-bot in #17230
• Update setup-testlens to v1.9.4 (#17223) by @chrisvest in #17229
• Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by @netty-project-bot in #17241
• Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by @netty-project-bot in #17251
• Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by @netty-project-bot in #17265
• Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by @netty-project-bot in #17268
• Respect max messages per read in LocalServerChannel (#17255) by @normanmaurer in #17269
• Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by @netty-project-bot in #17275
• Bzip2: Correctly detect overflow during block size bound check (#17261) by @normanmaurer in #17273
• Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by @netty-project-bot in #17280
• Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by @normanmaurer in #17282
• Extract Bootstrap and ServerBootstrap setup to a common method (#15134) by @normanmaurer in #17289
• Release channel when FixedChannelPool acquire is cancelled (#17287) by @normanmaurer in #17291
• Auto-port 4.1: HTTP: Release content encoder after header mutation failure by @netty-project-bot in #17294
• Auto-port 4.1: Add a script that can download GHSA vulnerability reports by @netty-project-bot in #17302
• Auto-port 4.1: FileRegion: Remove outdated JDK upgrade warning by @netty-project-bot in #17311
• Auto-port 4.1: codec-dns: Fix query OPCODE bit offset and mask by @netty-project-bot in #17316
• Auto-port 4.1: Install patchelf as part of awslc docker image generation by @netty-project-bot in #17322
• Auto-port 4.1: POOL: Close active unhealthy channels on release by @netty-project-bot in #17319
• Update to use graal 21 by @normanmaurer in #17327
• Auto-port 4.1: Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @netty-project-bot in #17329
• Fix graal docker file usage by @normanmaurer in #17333
• Auto-port 4.1: codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @netty-project-bot in #17332
• Kqueue: Continue reading when EOF is received before notify about channel inactivity by @normanmaurer in #17309
• Auto-port 4.1: Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @netty-project-bot in #17338
• Auto-port 4.1: Increase timeout in test to address flakyness by @netty-project-bot in #17345
• Auto-port 4.1: DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @netty-project-bot in #17347
• Close Channel when connect is cancelled during resolution (#17321) by @normanmaurer in #17349
• Auto-port 4.1: Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @netty-project-bot in #17351
• Auto-port 4.1: Http2: Cleanup child channel method signatures by @netty-project-bot in #17355
• Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in #17361
• Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in #17365
• Fix JdkZlibDecoder silently truncating highly compressible streams by @renechoi in #17364
• Auto-port 4.1: ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @netty-project-bot in #17369
• Auto-port 4.1: Update to latest netty tcnative version by @netty-project-bot in #17398
• Bulk merge for 4.1 by @normanmaurer in #17403

Full Changelog: netty-4.1.137.Final...netty-4.1.138.Final