chore(deps): bump netty from 4.1.133.Final to 4.2.15.Final by dependabot[bot] · Pull Request #40 · apopovsky/WPrimeKarooExtension

dependabot · 2026-06-08T06:55:01Z

Bumps netty from 4.1.133.Final to 4.2.15.Final.
Updates io.netty:netty-codec-http2 from 4.1.133.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-http from 4.1.133.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-common from 4.1.133.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-common's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-handler from 4.1.133.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec from 4.1.133.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-handler-proxy from 4.1.133.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-handler-proxy's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-50020: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting...

Description has been truncated

Bumps `netty` from 4.1.133.Final to 4.2.15.Final. Updates `io.netty:netty-codec-http2` from 4.1.133.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec-http` from 4.1.133.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.15.Final) Updates `io.netty:netty-common` from 4.1.133.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.15.Final) Updates `io.netty:netty-handler` from 4.1.133.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec` from 4.1.133.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.15.Final) Updates `io.netty:netty-handler-proxy` from 4.1.133.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.15.Final) --- updated-dependencies: - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.netty:netty-common dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.netty:netty-handler dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.netty:netty-codec dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.netty:netty-handler-proxy dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-08T06:55:02Z

Labels

The following labels could not be found: dependencies, gradle. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump netty from 4.1.133.Final to 4.2.15.Final#40

chore(deps): bump netty from 4.1.133.Final to 4.2.15.Final#40
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/gradle/netty-4.2.15.Final

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 8, 2026

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants