| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: netty-bom | Distribution: openSUSE Tumbleweed |
| Version: 4.1.140 | Vendor: openSUSE |
| Release: 1.1 | Build date: Tue Nov 3 10:06:25 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 13446 | Source RPM: netty-4.1.140-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://netty.io/ | |
| Summary: POM-only artifacts for netty | |
POM-only artifacts for netty.
Apache-2.0
* Tue Nov 03 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.140
* Security fixes:
+ GHSA-m77g-r4c7-3w77, bsc#1289154: out-of-bounds read in
netty-buffer
+ GHSA-rx4g-qxm6-238r, bsc#1289155: out-of-bounds read in
netty-buffer
+ GHSA-cqmg-wc9g-fpj8, bsc#1289156: insufficient entropy in
netty-resolver-dns
+ GHSA-hc9x-r52h-gh4x, bsc#1289157: unbounded memory usage in
netty-codec-http2
+ GHSA-42mp-m8rq-6rgj, bsc#1289158: insufficient control
character neutralization in netty-codec-http
+ GHSA-qhw9-p586-v948, bsc#1289159: out-of-bounds read in
netty-buffer
+ GHSA-84gx-4cj4-rm7q, bsc#1289160: unbounded memory usage in
netty-codec-mqtt
+ GHSA-6xv6-9mgg-mfvc, bsc#1289161: mTLS auth bypass via session
resumption in netty-handler
* Other significant changes:
+ Reject Redis lines that start with LF #17806
+ Do not let a negatively cached search domain shadow a positive
one #17805
+ Choose server key types from client's signature algorithms for
TLS 1.3 #17809
+ LocalChannel: Deliver data written by the peer before it
closed #17815
+ Validate padding of HEADERS frames without priority #17819
+ Don't spin in SslHandler.wrapMultiple(...) when the engine
consumes nothing #17822
+ Preserve invalid SNI names in ReferenceCountedOpenSslEngine
[#17824]
+ Optimize redundant bounds checking in ByteBuf.setBytes #17827
+ Release the DNS response when a query future loses a cancel
race #17828
+ Fix HpackDynamicTable losing entries when filled to capacity
[#17846]
+ Throw UnsupportedOperationException from
AdaptiveByteBuf.memoryAddress() without an address #17842
+ Handle ed25519 and ed448 names in SignatureAlgorithmConverter
[#17850]
+ HAProxyMessage: validate the length of all TLV types #17845
+ Validate bzip2 Huffman code lengths before building decode
tables #17855
+ Validate header values on DefaultHeaders.copy(), bulk add,
entry setValue and ReadOnlyHttpHeaders #17854
+ Fix typos in comments/javadoc #17863
+ HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers #17860
+ Throw DecompressionException on JdkZlib preset dictionary
mismatch #17864
+ Apply certificate list size floor #17861
+ Reject HTTP version numbers that overflow int #17859
+ HAProxyMessage: decode TLVs with an empty value at the end of
the header #17877
+ Honor maxAllocation for brotli in
DelegatingDecompressorFrameListener #17881
+ Reject invalid content-length in PUSH_PROMISE with a stream
error #17875
+ HAProxyMessageDecoder: fix v2 header framing with a non-zero
reader index #17882
+ Skip JNDI nameserver lookup on IBM i #17892
+ Reset the h2c upgrade stream if the request can not be
converted #17893
+ Fix NPE in Http2FrameCodec when h2c upgrade fails #17899
+ Don't size ZstdDecoder output buffers from the frame content
size #17900
+ Don't lose frames when a delimiter is split across reads
[#17909]
+ Read SOCKS5 length octets unsigned in the legacy socks
decoders #17916
+ Fix truncated output in Brotli decoders #17923
+ Port: Wrap trailing ';' in Content-Disposition as
ErrorDataDecoderException #17931
+ Kqueue: Deregister filters before closing the fd to avoid
hitting a reused fd #17939
+ Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on
activation #17935
+ Accept empty non-final fragments in PerMessageDeflateEncoder
[#17953]
+ HTTP/2: Don't pass the close promise to a deferred close
[#17959]
+ Fix endless value iterators in ReadOnlyHttpHeaders #17978
+ Don't drop the last character in
AsciiString.trim(CharSequence) #17993
+ Fix the region copied by Unpooled.copiedBuffer(CharSequence,
int, int, Charset) #17995
+ Add HpackDecoder test for non-token HTTP/2 header names #17992
+ Fix AsciiString.contains(...) false negatives after a partial
match #17986
+ Treat DATA frames on reserved HTTP/2 streams as a connection
error #17998
+ Reject reply codes with non-digit characters in
SmtpResponseDecoder #18005
+ Don't loop forever in AbstractDiskHttpData when the file is
short #18004
+ Http2: reject generic frames whose payload exceeds
SETTINGS_MAX_FRAME_SIZE #18000
+ Return null or the default from read-only headers for invalid
values #18017
+ Check the second gzip magic byte in JdkZlibDecoder #18007
+ Fix server-initiated WebSocket close handshake failing with
"promise already done" #18032
+ Fix Snappy.encode(...) for input with a non-zero reader index
[#18031]
+ MqttEncoder: Reject Variable Byte Integers larger than
268435455 #18025
+ Only delete socket files when binding and closing UDS channels
[#18044]
+ Return the haystack's reader index from
ByteBufUtil.indexOf(...) for an empty needle #18082
+ Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII
bytes #18083
+ Fail to encode DNS messages that are too large for TCP #18081
+ Don't return an entry twice when removing while iterating a
primitive map #18087
+ Mark disk-based HttpData as completed after setting empty
content #18088
+ Fix out-of-bounds read when validating UDS paths in the native
code #18016
+ Release a SPDY DATA frame that exceeds the session window
[#18094]
+ Send zero-length datagrams instead of dropping or duplicating
them #18107
+ Reject request-only and response-only pseudo-headers in
invalid contexts (RFC 9113) #18113
+ Read all pending data when the EOF is received before the
connect is complete in kqueue #18116
+ Read the 4 byte Snappy literal length as unsigned #18120
+ Deliver all data a LocalChannel peer wrote before it closed
[#18128]
+ Close an HTTP/2 stream only after its last merged DATA frame
was written #18144
+ Use IP_MULTICAST_IF in leaveGroup and block without an
interface #18152
+ Don't lose the alert when the handshake fails in
ReferenceCountedOpen… #18157
+ Send bad_certificate alert when the TrustManager rejects the
certificate #18181
+ SslHandler: Size the unwrap output buffer for the plaintext,
not the record #18182
+ Add opt-in Origin validation to WebSocketServerProtocolHandler
(hardening) #18184
+ Fix reporting of the wrong error when setting flags on an
accepted fd fails #18196
+ Epoll: Verify the FileChannel is a FileChannelImpl before
reading its fd #18190
+ KQueue: Verify the FileChannel is a FileChannelImpl before
reading its fd #18191
+ Do not send uninitialized stack memory when sending a fd over
a domain socket #18197
+ Fix read of uninitialized memory when accepting a connection
on a domain socket #18195
+ Epoll: Fix signed integer overflow when calculating the
epoll_wait timeout #18194
+ Fix underflow detection in
netty_unix_util_timespec_subtract_ns #18193
+ Don't encode Snappy copies with an offset that does not fit
into 16 bits #18224
+ Don't truncate binary memcache key and extras lengths #18225
+ Update to latest netty-tcnative release #18236
+ Security fixes #18238
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rebase
* Wed Oct 14 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.139
* Security fixes:
+ GHSA-frq3-7pw6-36cg, bsc#1285691: parser desync in
io.netty:netty-codec-haproxy
+ GHSA-6g26-xhvx-g5w3, bsc#1285692: improper CRLF neutralization
(request/response smuggling) in io.netty:netty-codec-http
+ GHSA-x9f7-rg73-4rp6, bsc#1285693: origin validation error in
io.netty:netty-codec-http
+ GHSA-2p3h-phr9-jf38, bsc#1285694: unbounded resource
consumption in io.netty:netty-codec-http2
+ GHSA-vwgc-hvc9-2j59, bsc#1285695: request/response smuggling
in io.netty:netty-codec-http
+ GHSA-m3w2-2657-46g8, bsc#1285696: time-of-check/time-of-use
error in io.netty:netty-handler-ssl-ocsp
+ GHSA-jp47-57pp-4qpp, bsc#1285697: SNI routing bypass in
io.netty:netty-handler
+ GHSA-35qr-v9mm-35c5, bsc#1285698: unbounded resource
consumption in io.netty:netty-codec-xml
+ GHSA-5h6f-wp3f-6hmv, bsc#1285699: unbounded resource
consumption in io.netty:netty-codec-base
+ GHSA-x436-m93c-g2q9, bsc#1285700: unbounded resource
consumption in io.netty:netty-codec-http
+ GHSA-c7hc-m259-xhcr, bsc#1285701: input misinterpretation in
io.netty:netty-codec-socks
+ GHSA-268p-9r42-7qp4, bsc#1285702: improper access control in
io.netty:netty-handler
+ GHSA-3h79-3wcf-5whr, bsc#1285703: unbounded resource
consumption in io.netty:netty-codec-dns
* Other significant changes:
+ Perf: Use LinkedHashSet to deduplicate search domains #17407
+ Handle non-positive skip lengths in ByteBufInputStream #17410
+ Protobuf: Update protobuf-javanano to non alpha release #17335
+ HttpUtil.getCharset() must accept whitespace before the next
Content-Type parameter #17436
+ Codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD
records #17459
+ HttpUtil.getMimeType() must not include whitespace before the
next Content-Type parameter #17494
+ Fix buffer leak when recvmmsg returns single UDP_GRO batch
[#17500]
+ Guard ChunkedWriteHandler.doFlush() against re-entrant
invocation from user code #17501
+ Add regression test for close() cascade reentering flush()
[#17505]
+ Fix UDP_GRO segment size is lost when reading with recvmmsg
[#17506]
+ Add workflow that will cancel running workflows for merged PRs
[#17519]
+ HTTP/2: Remove failed SETTINGS from ACK queue #17534
+ ProtobufVarint32FrameDecoder must wait for more data when the
length prefix is incomplete #17553
+ Fix missing readable-bytes check in SmtpResponseDecoder #17556
+ Guard against out-of-bounds reads when parsing ClientHello SNI
extension #17558
+ Http2: Reserve promised stream before running the request
verifier #17563
+ Use random generated LocalAddress in tests that use local
transport #17579
+ Use isLengthEqual method in HttpObjectDecoder #17575
+ Reject incomplete PUSH_PROMISE request headers when
validateRequiredPseudoHeaders is enabled #17582
+ POOL: Release Channel when SimpleChannelPool acquire is
cancelled #17578
+ Http2ConnectionHandler: report at most one stream error for a
CompositeStreamException #17595
+ Support creating a PropertyKey that is not tied to a specific
Http2Connection #17615
+ Reset LengthFieldBasedFrameDecoder state when the frame is
shorter than initialBytesToStrip #17621
+ Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the
buffer's own internal NIO buffer #17626
+ Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE
overflow issue #17640
+ Add missing bounds check to AdaptiveByteBuf.getBytes(...)
channel variants #17629
+ Update lz4-java to 1.12.0 #17638
+ HTTP/2: Fix stream stall when toggling auto-read on a child
channel #17646
+ No need to call clear() on ByteBuffer after AdaptiveByteBuf
.internalNioBuffer() #17653
+ PendingWriteQueue: unlink the write before failing it in
removeAndFail #17658
+ Don't lose HashedWheelTimer timeouts that race with stop()
[#17660]
+ LocalChannel: complete connect() when the accepted channel
dies before registration #17666
+ Don't leak FixedChannelPool slots on unrelated
IllegalArgumentException #17668
+ Don't corrupt the pipeline when a handler context is removed
twice #17670
+ Don't leak queued writes in ChunkedWriteHandler on removal or
cancel #17676
+ Honour the needle's reader index in ByteBufUtil
.indexOf(ByteBuf, ByteBuf) #17687
+ Close idle outbound HTTP/2 child channels when the parent
closes #17694
+ Only fail in ZlibDecoder when the decompression buffer is full
[#17698]
+ Add script that allows to check if a user has signed the ICLA
[#17713]
+ Fail pending writes of ProxyHandler when it is removed #17707
+ Complete HTTP/2 graceful close when the connection closes the
last stream #17720
+ Don't count STOMP headers again when the header block is
replayed #17716
+ Don't corrupt ChannelOutboundBuffer when a cancelled write
makes the channel writable #17733
+ Fail ChunkedNioFile instead of spinning when the file is
shorter than requested #17734
+ Arm force-close timeout when an inbound CLOSE frame is echoed
[#17710]
+ MqttDecoder accepts malformed MQTT 5 property sections and
reclassifies payload bytes as properties #17732
+ Validate bzip2 Huffman table selector index before use #17738
+ Fix retainedSlice() of non-retained pooled derived buffers
[#17761]
+ Reset the per-message-deflate compressor after an empty final
fragment #17741
+ Bulk merge changes for 4.1 #17771
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* no-werror.patch
+ rebase
* Thu Sep 24 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.138
* Security fixes:
+ CVE-2026-93488, bsc#1282084: unbounded resource usage in
io.netty:netty-codec-http (SPDY)
+ CVE-2026-93491, bsc#1282085: unbounded resource usage in
io.netty:netty-codec-http (HTTP/1.1)
+ CVE-2026-93492, bsc#1282132: denial of service vector in
io.netty:netty-codec-http2
+ CVE-2026-93493, bsc#1281431: improper certificate validation
in io.netty:netty-handler-ssl-ocsp
+ CVE-2026-93494, bsc#1282506: memory leak in io.netty
:netty-codec-stomp
+ CVE-2026-93558, bsc#1282140: unbounded resource usage in
io.netty:netty-codec-http
+ CVE-2026-93560, bsc#1282141: denial of service vector in
io.netty:netty-codec-stomp
+ CVE-2026-89044, bsc#1280048: parser desync/response smuggling
in io.netty:netty-codec-memcache
+ CVE-2026-93562, bsc#1282362: improper header validation in
io.netty:netty-codec-http
+ CVE-2026-93563, bsc#1281432: unbounded resource usage in
io.netty:netty-codec-smtp
+ CVE-2026-93564, bsc#1282363: memory leak in
io.netty:netty-codec-haproxy
+ CVE-2026-93565, bsc#1282364: request smuggling in
io.netty:netty-codec-http (RTSP)
+ CVE-2026-93566, bsc#1282366: request smuggling in
io.netty:netty-codec-http (HTTP/1)
+ CVE-2026-93567, bsc#1282367: improper header validation in
io.netty:netty-codec-http2
+ CVE-2026-93568, bsc#1282370: improper header validation in
io.netty:netty-codec-http2
+ CVE-2026-93569, bsc#1282372: improper header validation in
io.netty:netty-codec-http2
+ CVE-2026-93572, bsc#1281433: unbounded resource usage in
io.netty:netty-codec-redis
+ CVE-2026-93573, bsc#1282373: improper header validation in
io.netty:netty-codec-http (HTTP/1.1)
+ CVE-2026-93574, bsc#1282374: request smuggling vector in
io.netty:netty-codec-http (HTTP/1.1)
+ CVE-2026-93575, bsc#1281434: unbounded resource usage in
io.netty:netty-codec-mqtt
+ CVE-2026-93576, bsc#1282507: improper CRLF neutralization in
io.netty:netty-codec-smtp
+ CVE-2026-93578, bsc#1281435: improper certificate validation
in io.netty:netty-handler-ssl-ocsp
+ CVE-2026-93579, bsc#1282378: improper header validation in
io.netty:netty-codec-http2
* Other significant changes:
+ QUIC explicitly requires X509ExtendedTrustManager when
hostname verification is enabled
+ HTTP/2 header value validation is now enabled by default
+ Use X509ExtendedTrustManager in SSLErrorTest
+ Validate chunked-must-be-last regardless of HTTP version
+ Update junit version
+ Add system property to disable RFC 6761 localhost resolution
+ Update setup-testlens to v1.9.4 (#17223)
+ Adjust failsafe plugin version to be in sync with surefire
plugin
+ Release unsent LastHttpContent in HttpChunkedInput
+ HTTP/2: Release compressors after failed headers writes
+ HTTP/2: Prevent reentrant flush on writability change
+ Respect max messages per read in LocalServerChannel (#17255)
+ HTTP: Preserve encoder state after header encoding failures
+ Bzip2: Correctly detect overflow during block size bound
check (#17261)
+ HTTP/2: Drain queued frames stranded by a writability change
during flush
+ Add clock skew tolerance to OcspServerCertificateValidator
+ Extract Bootstrap and ServerBootstrap setup to a common
method (#15134)
+ Release channel when FixedChannelPool acquire is cancelled
(#17287)
+ HTTP: Release content encoder after header mutation failure
+ Add a script that can download GHSA vulnerability reports
+ FileRegion: Remove outdated JDK upgrade warning
+ codec-dns: Fix query OPCODE bit offset and mask
+ Install patchelf as part of awslc docker image generation
+ POOL: Close active unhealthy channels on release
+ Update to use graal 21
+ Add more logging to CompositeBufferGatheringWriteTest to help
diagnose flaky test
+ Fix graal docker file usage
+ codec-dns: Report and allow setting full 16-bit EDNS(0) flags
field
+ Kqueue: Continue reading when EOF is received before notify
about channel inactivity
+ Fix MQTT 5 properties length decoding for multi-byte Property
Length (4.2 branch)
+ Increase timeout in test to address flakyness
+ DatagramUnicastIpv6MappedTest should explicit bind to ipv4
address to make test less flaky
+ Close Channel when connect is cancelled during resolution
(#17321)
+ Channel: Add unit tests for AbstractChannel edge-case
failures and buffer releases
+ Http2: Cleanup child channel method signatures
+ Update to latest netty-tcnative release
+ Update to latest netty-jni-util release
+ Fix JdkZlibDecoder silently truncating highly compressible
streams
+ ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is
enough
+ Update to latest netty tcnative version
- Changes of 4.1.137
* Security fixes:
+ CVE-2026-75596, bsc#1276421: algorithm inefficiency in
io.netty:netty-handler
+ CVE-2026-62380, bsc#1276456: improper NUL byte neutralization
in io.netty:netty-codec-socks
+ CVE-2026-75595, bsc#1276420: SNI bypass in io.netty
:netty-handler
+ CVE-2026-59902, bsc#1275501: memory exhaustion in
io.netty:netty-transport-sctp
+ CVE-2026-59903, bsc#1275500: cache poisoning & info disclosure
in io.netty:netty-codec-http
+ CVE-2026-76816, bsc#1277243: validation bypass in
io.netty:netty-codec-mqtt
+ CVE-2026-62243, bsc#1276455: improper hostname verification in
io.netty:netty-handler
* Other significant changes:
+ AsciiString.cached(String) should sanitize the provided
String (#13749)
+ AsciiString.cached(String) should sanitize the provided
String (#13749) (#17007)
+ Fix AsciiString.cached(String) performance regression
(#17074)
+ SslHandler: Fix possible buffer leak when an OOME is thrown
during allocation
+ Fix AsciiString.cached(String) performance regression
(#17074)
+ Add HttpContentCompressor constructor with ability to specify
desired maxPipelineDepth
+ Fix AdaptiveByteBuf._setLongLE calling checked setLongLE
+ Reject negative maxOrder in PooledByteBufAllocator
+ Snappy: Guard decoder against invalid chunk lengths
+ Backport #16079 and #17114
+ Use safe decompressor in Lz4FrameDecoder
+ Configure TestLens for the PR builds
+ Fix maxAllocation for brotli-encoded content in
HttpContentDecompressor (#17037)
+ Propagate the CI envionment variables through to the docker
builds (#17138)
+ fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding
+ Fix buddy cache evicting chunks with live buffers (#17154)
+ Avoid classloader leak via GlobalEventExecutor
terminationFuture failure
+ HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak
when a Throwable is thrown during header encoding
+ BrotliEncoder: Prevent duplicate close scheduling (#17175)
+ Update compress-lzf to 1.2.1
+ Do not write WebSocket handshake response to the tail of the
pipeline (#17192)
+ HttpServerCodec: do not consume the method queue for 1xx
interim responses (#17182)
+ Adaptive allocator backports
+ Weakly reference engines from the OpenSSL engine map (#17199)
+ Add .editorconfig to enforce consistent coding style
+ Update surefire plugin to latest version (#17210)
+ Update to latest netty-tcnative release (#17056)
+ Merge changes from forks (#17213)
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rebase
* Tue Jul 21 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.136
* Security fixes:
+ CVE-2026-44891, bsc#1271435: memory exhaustion in
io.netty:netty-codec-stomp
+ CVE-2026-55833, bsc#1271961: zip bomb in
io.netty:netty-codec-http
+ CVE-2026-59921, bsc#1272307: improper CR/LF neutralization in
io.netty:netty-codec-http (multipart)
+ CVE-2026-59919, bsc#1272305: improper CR/LF neutralization in
io.netty:netty-codec-haproxy
+ CVE-2026-55851, bsc#1272253: memory exhaustion in
io.netty:netty-codec-haproxy
+ CVE-2026-56745, bsc#1272254: memory exhaustion in
io.netty:netty-codec-http
+ CVE-2026-56817, bsc#1272257: insecure defaults in XML parsing
in io.netty:netty-codec-xml
+ CVE-2026-59899, bsc#1272301: memory exhaustion in
io.netty:netty-codec-http
+ CVE-2026-56818, bsc#1272603: memory leak in
io.netty:netty-codec-redis
+ CVE-2026-56819, bsc#1272258: memory leak in
io.netty:netty-codec-http2
+ CVE-2026-55831, bsc#1271960: resource exhaustion/DoS in
io.netty:netty-codec-http
+ GHSA-mfg7-5gfp-c4w3, bsc#1272519: memory leak in
io.netty:netty-codec-dns
+ CVE-2026-59901, bsc#1272304: infinite loop in
io.netty:netty-codec-compression (bzip2)
+ CVE-2026-59900, bsc#1272303: improper header neutralization in
io.netty:netty-codec-http2
+ CVE-2026-59898, bsc#1272302: protocol version confusion in
io.netty:netty-codec-http (websocket)
+ CVE-2026-56746, bsc#1272255: improper access control in
io.netty:netty-codec-http (CORS)
+ CVE-2026-56822, bsc#1272300: time-of-check/time-of-use in
io.netty:netty-handler-ssl-ocsp
+ GHSA-v74w-7mr3-4qg3, bsc#1272518: uncontrolled resource
consumption in io.netty:netty-codec-xml
+ CVE-2026-56820, bsc#1272259: improper certificate validation
in io.netty:netty-handler-ssl-ocsp
+ CVE-2026-56821, bsc#1272299: improper certificate revocation
check in io.netty:netty-handler-ssl-ocsp
+ CVE-2026-59920, bsc#1272306: improper CR/LF neutrolization in
io.netty:netty-codec-stomp
* Other significant changes:
+ SingleThreadEventExecutor: document Throwable safety contract
on run()
+ Make HTTP/2 frame hashCode consistent with equals
+ Add BlockHound exception for DnsQueryIdSpace (#16896)
+ FlowControlHandler: Fix autoRead behavior
+ Fix incorrect bounds in error message of
HpackDecoder.setMaxHeaderListSize
+ MQTT: Fix MQTT decoder size check after variable header replay
+ MQTT: Make the decodeProperties early-REPLAY check actually
fire
+ Reject control characters at the boundary of HTTP method names
(#16723)
+ Update to latest tcnative release
+ Fix HTTP 2 PUSH_PROMISE stream association validation
+ Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder
+ Add opt-in validation of mandatory pseudo-header fields for
HTTP/2
+ Strictly validate MQTT UTF-8 Encoded String (#16939)
+ Stop DateFormatter trailing token from running past the parse
end
+ IpFilter: Deprecate constructor which use accept by default
+ Add RFC 10008 QUERY Method support (#16966)
+ Correctly release and fail queued traffic-shaping writes on
close (#16959)
+ FlowControlHandler: respect auto-read when toggled while
dequeueing
+ IdleStateHandler: reset firstWriter/ReaderIdleEvent in
resetWriteTimeout/resetReadTimeout (#16982)
+ Fix typo in AbstractSniHandler Javadoc
+ Reconcile AbstractCoalescingBufferQueue readableBytes when it
drains, and fail stuck HTTP/2 streams instead of spinning
empty DATA frames
+ Reject control characters at the boundary of the HTTP version
token (#16971)
+ Reset UTF-8 decode state on CR in StompSubframeDecoder
+ HTTP2: Pass the correct number of arguments when logging
goaway
+ FastLz: Guard decompression against truncated input (#17000)
+ Fix propagation of startTls for client SslContext handler
+ Reject non-token characters in HTTP/2 header names
+ Update lz4-java to 1.11.1
+ Pin github actions to reduce risk (#17043)
+ Merge branches from forks (#17063)
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Fri Jun 12 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.135
* Security fixes:
+ CVE-2026-48059, bsc#1268258: memory exhaustion in
io.netty:netty-codec-haproxy
+ CVE-2026-47691, bsc#1268252: DNS cache poisoning in
io.netty:netty-resolver-dns
+ CVE-2026-50560, bsc#1268262: DDoS in
io.netty:netty-codec-http2
+ CVE-2026-50011, bsc#1268260: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-44250, bsc#1268169: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-44890, bsc#1268170: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-44249, bsc#1268165: IPv6 subnet filter bypass in
io.netty:netty-handler
+ CVE-2026-50020, bsc#1268261: request smuggling in
io.netty:netty-codec-http
+ CVE-2026-44893, bsc#1268244: memory leak in
io.netty:netty-codec-haproxy
+ CVE-2026-50010, bsc#1268259: TLS hostname verification
accidentally disabled in io.netty:netty-handler
+ CVE-2026-45673, bsc#1268248: DNS cache poisoning in
io.netty:netty-resolver-dns
+ CVE-2026-45416, bsc#1268246: excessive memory usage from
SNIHandler in io.netty:netty-handler
+ CVE-2026-45536, bsc#1268247: file descriptor leak in
io.netty:netty-transport-native-epoll and
io.netty:netty-transport-native-kqueue
+ CVE-2026-45674, bsc#1268249: DNS cache poisoning in
io.netty:netty-resolver-dns
+ CVE-2026-46340, bsc#1268250: memory exhaustion in
io.netty:netty-transport-sctp
+ CVE-2026-47244, bsc#1268251: denial of service in
io.netty:netty-codec-http2
+ CVE-2026-48006, bsc#1268255: memory exhaustion in
io.netty:netty-codec-redis
+ CVE-2026-48043, bsc#1268257: memory exhaustion in
io.netty:netty-codec-http2
* Other significant changes:
+ MQTT: Allow MQTT 5 CONNECT with password only
+ ChannelInitializer: correct misleading comment on
exceptionCaught route
+ HTTP/2: Parse request-target path like Vert.x (4.1 backport)
+ HttpObjectDecoder skips arbitrary initial control characters
when only initial CRLF characters are permitted
+ IpSubnetFilter: Correctly handle ipv6
+ Configurable bound on RedisArrayAggregator
+ Redis: Limit decoded length
+ DNS: Ensure query id is not predictible
+ Wrapping plain trust manager silently disables hostname
verification
+ MQTT: Reject malformed no-payload packets with non-zero
Remaining Length
+ HAProxy: Reject HAProxyMessages with malformated TLV and not
leak memory
+ SSL: Use sane defaults as limits for the client hello length
and timeout
+ DNS: Only cache CNAME if part of the queried domain
+ HTTP/2: Enforce max concurrent streams for misbehaving clients
+ Dns: Insufficient Bailiwick Validation for NS Records
+ HTTP2: DelegatingDecompressorFrameListener must release memory
in all cases
+ Pass maxAllocation to Brotli and Zstd decoders
+ HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
+ Add maxWindowLog parameter to ZstdDecoder to bound memory
allocation
+ HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
+ Epoll / Kqueue: Correctly handle receive of FD
+ SCTP: Limit the number of inflight incomplete SCTP messages
and the number of fragments
+ Redis: Correctly release incomplete message on removal when
using RedisArrayAggregator
+ Redis: Limit the maximum number of nested arrays
+ HTTP: Re-add constructor to HttpProxyHandler that was removed
by mistake
+ Marshalling: Explicit document security requirements
+ Pin HTTP/RTSP version + method normalization to Locale.US
+ Adaptive: Fix concurrency issue in adaptive allocator
+ Pin multipart Content-Type / Content-Transfer-Encoding case
folding to Locale.US
+ Remove dead native declarations
+ Avoid re-parsing openssl key material with non-cached provider
+ IpFilter: Fix ClassCastException caused by IpSubnetFilter if
only ipv6 rules are configured but remote peer is using ipv4
+ Resolve all localhost addresses without querying DNS servers
+ HTTP2: Use 100 as default max concurrent streams setting
+ Route synchronous onLookupComplete exceptions via
fireExceptionCaught
+ Fix MQTT decoder size check after variable header replay
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Fri May 15 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.133
* Security fixes:
+ CVE-2026-42586, bsc#1265245 (netty-codec-redis)
+ CVE-2026-42578, bsc#1265243 (netty-handler-proxy)
+ CVE-2026-42587, bsc#1265246 (netty-codec-http,
netty-codec-http2)
+ CVE-2026-41417, bsc#1264350 (netty-codec-http)
+ CVE-2026-42581, bsc#1265277 (netty-codec-http)
+ CVE-2026-42580, bsc#1265273 (netty-codec-http)
+ CVE-2026-42585, bsc#1265292 (netty-codec-http)
+ CVE-2026-42579, bsc#1265272 (netty-codec-dns)
+ CVE-2026-42582 (netty-codec-http3)
+ CVE-2026-42583, bsc#1265279 (netty-codec,
netty-codec-compression)
+ CVE-2026-42584, bsc#1265280 (netty-codec-http)
+ CVE-2026-44248, bsc#1265294 (netty-codec-mqtt)
* Other significant changes:
+ Fix IndexOutOfBoundsException in StompSubframeDecoder on
heartbeat
+ Kqueue: sendfile EINTR doesn't advance offset - data
duplication
+ Avoid leak in PemReader on OutOfDirectMemoryError
+ Native DNS resolver: Guard against malloc failures
+ Include user properties and subscription IDs in
MqttProperties#isEmpty
+ Fix parsing HTTP chunks with multiple extensions
+ Epoll: Cleanup code to always return negative value on failure
+ Native transports: Correctly create pipe when pipe2 is not
supported
+ Use stream error for maxContentLength exceeded in
InboundHttp2ToHttpAdapter
+ Fix shutdownInput bug in kqueue for empty recv buffer
+ Kqueue: Fix usage of LOCAL_PEERPID
+ HTTP2: Ensure HTTP2 preface is always send as first message
+ HTTP2: Ensure HTTP2 preface is always send as first message
(also on the server)
+ Deprecate ObjectCleaner and remove usage
+ Update to netty-tcnative 2.0.77.Final
+ Avoid NPE in JdkSslServerContext when TrustManagerFactory
returns null
+ Avoid NPE in JdkSslClientContext when TrustManagerFactory
returns null
+ SCTP: Correctly handle SO_BACKLOG
* Mon Mar 30 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.132
* Fixes:
+ Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR
retry loop
+ Make RefCntOpenSslContext.deallocate more robust
+ HTTP2: Correctly account for padding when decompress
+ Fix high-order bit aliasing in HttpUtil.validateToken
+ fix: the precedence of + is higher than >>
+ AdaptiveByteBufAllocator: make sure byteBuf.capacity() not
greater than byteBuf.maxCapacity()
+ AdaptivePoolingAllocator: call unreserveMatchingBuddy(...)
if byteBuf initialization failed
+ Don't assume CertificateFactory is thread-safe
+ Fix HttpObjectAggregator leaving connection stuck after 413
with AUTO_READ=false
+ HTTP2: Ensure preface is flushed in all cases
+ Fix UnsupportedOperationException in readTrailingHeaders
+ Fix client_max_window_bits parameter handling in
permessage-deflate extension
+ Native transports: Fix possible fd leak when fcntl fails.
+ Kqueue: Fix undefined behaviour when GetStringUTFChars fails
and SO_ACCEPTFILTER is supported
+ Kqueue: Possible overflow when using
netty_kqueue_bsdsocket_setAcceptFilter(...)
+ Native transports: Fix undefined behaviour when
GetStringUTFChars fails while open FD
+ Epoll: Add null checks for safety reasons
+ Epoll: Use correct value to initialize mmsghdr.msg_namelen
+ Epoll: Fix support for IP_RECVORIGDSTADDR
+ AdaptivePoolingAllocator: remove ensureAccessible() call in
capacity(int) method
+ Epoll: setTcpMg5Sig(...) might overflow
+ JdkZlibDecoder: accumulate decompressed output before firing
channelRead
+ Limit the number of Continuation frames per HTTP2 Headers
(bsc#1261043, CVE-2026-33871)
+ Stricter HTTP/1.1 chunk extension parsing (bsc#1261031,
CVE-2026-33870)
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Fri Mar 13 2026 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.131
* Fixes:
+ NioDatagramChannel.block(...) does not early return on failure
+ Support for AWS Libcrypto (AWS-LC) netty-tcnative build
+ codec-dns: Decompress MX RDATA exchange domain names during
DNS record decoding
+ Buddy allocation for large buffers in adaptive allocator
+ SslHandler: Only resume on EventLoop if EventLoop is not
shutting down already
+ Wrap ECONNREFUSED in PortUnreachableException for UDP
+ Bump com.ning:compress-lzf (4.1)
+ Fix adaptive allocator bug from not noticing failed allocation
+ Avoid loosing original read exception
+ Backport multiple adaptive allocator changes
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* no-werror.patch
* reproducible.patch
+ rediff
* Tue Dec 16 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.130
* Fixes:
+ RLF injection vulnerability in io.netty.handler.codec.http
.HttpRequestEncoder (bsc#1255048, CVE-2025-67735)
+ Update lz4-java version to 1.10.1
+ Close Channel and fail bootstrap when setting a ChannelOption
causes an error
+ Discard the following HttpContent for preflight request
+ Fix race condition in NonStickyEventExecutorGroup causing
incorrect inEventLoop() results
+ Fix Zstd compression for large data
+ Fix ZstdEncoder not producing data when source is smaller than
block
+ Make big endian ASCII hashcode consistent with little endian
+ Fix reentrancy bug in ByteToMessageDecoder
+ Add 32k and 64k size classes to adaptive allocator
+ Re-enable reflective field accesses in native images
+ Correct HTTP/2 padding length check
+ Fix HTTP startline validation
+ Fix MpscIntQueue bug
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Thu Oct 23 2025 Fridrich Strba <fstrba@suse.com>
- Build against the org.jboss:jdk-misc artifact that is implementing
the sun.misc classes removed in Java 25
* Thu Oct 16 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.128
* Fixes
+ BouncyCastleAlpnSslUtils needs to use the correct SSLEngine
class as otherwise it will fail to init static fields
+ SMTP Command Injection Vulnerability Allowing Email Forgery
(bsc#1252097, CVE-2025-59419)
+ Drop unknown frame on missing stream in first packet
+ Precompute segments offsets and use them as segment's
identity
+ Empty chunks cannot be used while allocating from the shared
queue
+ Only register chunk sizes in adaptive allocator
+ Fix concurrent chunk data write bug in adaptive allocator
+ Update jni-util version to clarify licensing
+ Fix Snappy compression bug
+ Fix aligned off-heap zeroing
- Build against the netty-jni-util 0.0.10 sources
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
+ rediff
* Thu Sep 04 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.126
* Fixes
+ Decompression codecs vulnerable to DoS via zip bomb style
attack (bsc#1249134, CVE-2025-58057)
+ Request smuggling due to incorrect parsing of chunk extensions
(bsc#1249116, CVE-2025-58056)
+ Fix IllegalReferenceCountException on invalid upgrade response
+ Drop unknown frame on missing stream
+ Don't try to handle incomplete upgrade request
+ Make org.graalvm.nativeimage:svm optional in netty-common
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Fri Aug 22 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.124
* Fixes
+ MadeYouReset HTTP/2 DDoS vulnerability
(CVE-2025-55163, bsc#1247991)
+ Fix NPE and AssertionErrors when many tasks are scheduled and
cancelled
+ HTTP2: Http2ConnectionHandler should always use
Http2ConnectionEncoder
+ Epoll: Correctly handle UDP packets with source port of 0
+ Fix netty-common OSGi Import-Package header
+ MqttConnectPayload.toString() includes password
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Thu Jul 24 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upsteam version 4.1.123
* Fixes
+ Fix chunk reuse bug in adaptive allocator
+ More accurate adaptive memory usage accounting
+ Introduce size-classes for the adaptive allocator
+ Reduce magazine proliferation eagerness
+ Fix concurrent ByteBuffer access issue in
AdaptiveByteBuf.getBytes
+ Fix possible buffer corruption caused by incorrect
setCharSequence(...) implementation
+ AdaptiveByteBuf: Fix AdaptiveByteBuf.maxFastWritableBytes()
to take writerIndex() into account
+ Optimize capacity bumping for adaptive ByteBufs
+ AbstractDnsRecord: equals() and hashCode() to ignore name
field's case
+ Backport Unsafe guards
+ Guard recomputed offset access with hasUnsafe
+ HTTP2: Always produce a RST frame on stream exception
+ Correct what artifacts included in netty-bom
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Mon Jun 09 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.122
* Fixes of 4.1.122
+ DirContextUtils.addNameServer(...) should just catch Exception
internally
+ Make public API specify explicit maxAllocation to prevent OOM
+ Fix concurrent ByteBuf write access bug in adaptive allocator
+ Fix transport-native-kqueue Bundle-SymbolicNames
+ Fix resolver-dns-native-macos Bundle-SymbolicNames
+ Always correctly calculate the memory address of the ByteBuf
even if sun.misc.Unsafe is not usable
+ Upgrade lz4 dependencies as the old version did not correctly
handle ByteBuffer that have an arrayOffset > 0
+ Optimize ByteBuf.setCharSequence for adaptive allocator
+ Kqueue: Fix registration failure when fd is reused
+ Make JdkZlibEncoder accept Deflater.DEFAULT_COMPRESSION as
level
+ Ensure OpenSsl.availableJavaCipherSuites does not contain null
values
+ Always prefer direct buffers for pooled allocators if not
explicit disabled
+ Update to netty-tcnative 2.0.72.Final
+ Re-enable sun.misc.Unsafe by default on Java 24+
+ Kqueue: Delay removal from registration map to fix noisy
warnings
* Fixes of 4.1.121
+ Epoll.isAvailable() returns false on Ubuntu 20.04/22.04 arch
amd64
+ Fix transport-native-epoll Bundle-SymbolicNames
* Fixes of 4.1.120
+ Fix flawed termination condition check in
HttpPostRequestEncoder#encodeNextChunkUrlEncoded(int) for
current InterfaceHttpData
+ Exposed decoderEnforceMaxConsecutiveEmptyDataFrames and
decoderEnforceMaxRstFramesPerWindow
+ ThreadExecutorMap must restore old EventExecutor
+ Make Recycler virtual thread friendly
+ Disable sun.misc.Unsafe by default on Java 24+
+ Adaptive: Correctly enforce leak detection when using
AdaptiveByteBufAllocator
+ Add suppressed exception to original cause when calling
Future.sync*
+ Add SETTINGS_ENABLE_CONNECT_PROTOCOL to the default HTTP/2
settings
+ Correct computation for suboptimal chunk retirement
probability
+ Fix bug in method
AdaptivePoolingAllocator.allocateWithoutLock(...)
+ Fix a Bytebuf leak in TcpDnsQueryDecoder
+ SSL: Clear native error if named group is not supported
+ WebSocketClientCompressionHandler shouldn't claim window bits
support when jzlib is not available
+ Fix the assignment error of maxQoS parameter in ConnAck
Properties
* Fixes of 4.1.119
+ Replace SSL assertion with explicit record length check
+ Fix NPE when upgrade message fails to aggregate
+ SslHandler: Fix possible NPE when executor is used for
delegating
+ Consistently add channel info in HTTP/2 logs
+ Add QueryStringDecoder option to leave '+' alone
+ Use initialized BouncyCastle providers when available
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Thu Mar 27 2025 Fridrich Strba <fstrba@suse.com>
- Fix pom.xml errors that will be fatal with Maven 4
* Tue Feb 11 2025 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.118
* Fixes of 4.1.118
+ SslHandler doesn't correctly validate packets which can lead
to native crash when using native SSLEngine (bsc#1237037,
CVE-2025-24970)
+ Denial of Service attack on windows app using Netty, again
(bsc#1237038, CVE-2025-25193)
+ Upgrade netty-tcnative to 2.0.70.Final
+ Fix recycling in CodecOutputList
+ Allocate bytebuf without magazine lock when threads get
collisions
+ Make StreamBufferingEncoder not send header frame with
priority by default
+ Notify event loop termination future of unexpected exceptions
+ KQueueEventLoop leaks memory on shutdown
+ Fix AccessControlException in GlobalEventExecutor
+ Fix possible buffer leak when stream can't be mapped
+ AdaptivePoolingAllocator: Round chunk sizes up to
MIN_CHUNK_SIZE units and reduce chunk release frequency
* Fixes of 4.1.117
+ Fix classloader leaks in GlobalEventExecuto
+ Support BouncyCastle FIPS for reading PEM files
+ Dns: Correctly encode DnsPtrRecord
+ Provides Brotli settings without com.aayushatharva.brotli4j
dependency
+ Make DefaultResourceLeak more resilient against OOM
+ OpenSslSession: Add support to defensively check for peer
certs
+ Reentrant close in EmbeddedChannel
+ SslHandler: Ensure buffers are never leaked when wrap(...)
produce SSLException
+ Adaptive: Only use ThreadLocal if called from
FastThreadLocalThread in case of temporary byte[] allocation
+ Correcly handle comments appended to nameserver declarations
* Fixes of 4.1.116
+ PcapWriteHandler no longer ignores writePcapGlobalHeader
+ Allow PcapWriteHandler to output PCAP files larger than 2GB
+ Fix bugs in BoundedInputStream
+ AdaptiveByteBufAllocator will not use threadlocal magazine if
FastThreadLocalThread.willCleanupFastThreadLocals() returns
false
+ Fix HTTP header validation bug
+ Add range check for
AdaptivePoolingAllocator.CENTRAL_QUEUE_CAPACITY and
MAGAZINE_BUFFER_QUEUE_CAPACITY
+ Fix possible race condition in method
AdaptivePoolingAllocator.offerToQueue(...)
+ Make sure the sentinel Magazine.MAGAZINE_FREED not be replaced
+ Decrease usedMemory of magazine when the chunk get deallocate
+ Only try to use Zstd and Brotli if we can load the native libs
+ AdaptiveByteBufAllocator: Correctly manage used memory
strategy in all cases
+ Bump BlockHound version to 1.0.10.RELEASE
+ Add details to TooLongFrameException message
+ Adapt: Only add Chunk to central Queue if unused
+ Adapt: Don't fail when we run on a host with 1 core
+ Adapt: Ensure Chunks from the central Queue are re-used even
if there are Magazine local cached Chunks
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
+ rediff
* Thu Dec 05 2024 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.115
* Fixes:
+ Allow MessageToMessageDecoder to take care of reading more
data when needed
+ Fix SSL session resumption with ClientAuth.OPTIONAL and add
tests with session tickets
+ Fix incorrect cast in NioDomainSocketChannel.parent()
+ Fix bug where SslHandler may stall after TLSv1.3 handshake
with delegate tasks
+ AdaptiveByteBufAllocator: Make pooling of AdaptiveByteBuf
magazine local
+ Specialize Adaptive's allocator Recycler based on magazine's
owner
+ Fix epoll_wait retry loop
+ Log / include the correct error during handshake failure
+ Convey autoAckPing in http2 decoder constructor chain
+ Allow to set used named groups per OpenSslContext
+ Verify default named groups before using them with native SSL
implementation
+ Include details on why it was not possible to configure
accepted issuers in the SSLException
+ Correctly detect if KeyManager is not supported by OpenSSL
version
+ Preserve ordering of default named groups during conversation
+ Denial of Service attack on windows app using netty
(bsc#1233297, CVE-2024-47535)
- Split the netty-poms package in netty-parent and netty-bom
- Modified patch:
* 0001-Remove-optional-dep-Blockhound.patch
+ rediff
* Wed Nov 27 2024 Fridrich Strba <fstrba@suse.com>
- Clean a bit the spec file and adapt to the recent changes in
netty-tcnative package
- Removed patches:
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
+ remove the annotations with a macro in the jurand tool
* 0007-Do-not-require-the-tcnative-native-library.patch
+ we are building now the artifact, so we can require it
* Wed Oct 30 2024 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.114
* Fixes of 4.1.114:
+ Validate HTTP Method
+ Release AdaptiveByteBuf when ownership could not be transfered
+ Make arenas reuse their last chunk more aggressively
+ Only add Magazine to Set if we can ensure its removed again
+ Ensure Chunk will not leak if init of AdaptiveByteBuf fails
for whatever reason
+ Correctly release one-off allocated chunks
+ Ensure pooled memory is released when
AdaptivePoolingAllocator is GC'ed
+ Slices / duplicates of AdaptiveByteBuf must not escape the
rootParent
+ Fix sizeBucket bug in AdaptivePoolingAllocator
+ AdaptiveByteBufAllocator: More strict reference counting for
chunks
+ Ensure we not store the DnsQueryContext for later removal when
we couldnt obtain a query id
+ Reduce memory fragmentation
+ Properly free magazine chunks and avoid orphaned magazines
+ Magazines must be freed under the expand lock
+ Release message before failing promise when multiple requests
are written while upgrade is in progress.
+ Allow to reuse more then one session per host / port mapping
+ Ensure writes will not fail when triggered after receiving
UpgradeEvent.UPGRADE_SUCCESSFUL
+ Refactor DnsNameResolver to be able to use different
strategies when it comes to creating Channels for queries.
+ DnsNameResolver: allow users to skip bind() during bootstrap
+ DnsResolverBuilder methods should make it clear that these are
for DatagramChannel
* Fixes of 4.1.113:
+ feat: Support for IP_BIND_ADDRESS_NO_PORT socket option
+ Ensure AbstractCoalescingBufferQueue does not end up in
inconsistent state on error
+ Add new SslHandler.isEncrypted(...) variant that will not
produce false positives
+ Ensure flushes are not discarded by ChunkedWriteHandler for
passed through messages
+ Remove reference to parent in recycled buffers for leak
detection
+ Upgrade to netty-tcnative 2.0.66.Final
+ Cleanup fields on AdaptiveByteBuf::deallocate
* Fixes of 4.1.112:
+ Avoid unnecessary reflective probes on netty initialization
+ Allow control frames between fragments
+ Only delete the socket file for NioServerDomainSocketChannel
+ Add check for IPv6 brackets when address is unresolved
+ fix ResolvConf initialization with SecurityManager enabled
+ Fix potential DNS cache invalidation in
ResolveWithDotSearchDomain scenario
+ Backport the SslContextBuilder.endpointIdentificationAlgorithm
method
+ Aggressively remove PoolThreadCache references from its
finalizer object
+ Send Http2PriorityFrame through fireUserEventTriggered for
Http2MultiplexHandler
+ Fix potential DNS cache invalidation across different
EventLoops
+ Reject http header values with non SP / HTAB chars
+ Don't strip whitespaces from header names and let the
validator handle it
+ Reject request if NUL is present in the request line
+ Allow HTTP responses without reason-phrase
+ Validate HTTP version while decoding
+ Only include scopeId on link-local addresses when using native
transport
* Fixes of 4.1.111:
+ ReadOnlyByteBufferBuf | ReadOnlyUnsafeDirectByteBuf get, copy,
duplicate, slice methods should be safe to be called from
multiple threads
+ ReadyOnlyBuf must return false for isWritable() when sliced or
duplicated
+ ReadOnlyByteBuf (and sub-classes) does not create derived
buffers that share reference count
+ ByteBuf.asReadOnly().nioBuffer*() need to return read-only
ByteBuffer
+ Remove unwanted mandatory dependency in OSGi
+ HashedWheelTimer.stop() must cancel tasks
+ ZSTD decompression not resilient to compression bombs
+ Duplicate of slice should have the same capacity as the
original slice so that it's not writable
+ Optimize wrap buffer cumulation in SslHandler and don't mutate
input buffers
+ Prepare for unsafe memory access deprecated for removal
+ Fix AdaptiveByteBufAllocator class loading on Java 6/7
+ Add missing NULL checks in native code
* Fixes of 4.1.110:
+ Add unix domain socket transport in netty 4.x via JDK16+
+ Backport #13075: Add the AdaptivePoolingAllocator
+ Add no-value key handling only for form body
+ Add support for specifying SecureRandom in SSLContext
initialization
* Fixes of 4.1.109:
+ Utilize ByteBuf#indexOf
+ Don't send a RST frame when closing the stream in a write
future while processing inbound frames
+ Fix DefaultChannelId#asLongText NPE
+ Fix voidPromise in Http2FrameCodec.writeHeadersFrame
+ Make /etc/resolv.conf reading more robust
+ Fix NioSocketChannel usage in graalvm native-image
+ Improve ByteBufUtil#firstIndexOf
+ Rewrite ZstdDecoder to remove the need of allocate a huge
byte[] internally
+ Always log registered/detected ChannelInitializerExtension(s)
at INFO level
+ Enhance AsciiString#toLowerCase and AsciiString#toUpperCase
+ Add support for zstd http content decompression
+ Save Snappy's encode tmp table allocation
- Regenerated patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
* Tue Sep 24 2024 Bernhard Wiedemann <bwiedemann@suse.com>
- Add reproducible.patch to omit the mtime from libnetty-unix-common.a
for reproducible builds (boo#1047218)
* Wed Mar 27 2024 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.108
* Fixes of 4.1.108:
+ HttpPostRequestDecoder can OOM (bsc#1222045, CVE-2024-29025)
+ Add zstd decoder
+ Updated HTTP2 Reader to fix missing header state
+ codec-http2: fix some frame validation errors
+ SSL: Only wrap TrustManager if FIPS is not used
+ Epoll: Correctly handle splice tasks when Channel is closed
+ Allow to cancel connect() operations when using non-blocking
IO
+ DNS resolver final CNAME lookup disabled
+ DNS: Add DnsRecordType definitions for SVCB and HTTPS
+ SSL: Only try to use TLSv1.3 if a compatible ciphersuite is
configured
+ Backport 'Fix buffer leak in DefaultHttp2HeadersEncoder' to v4
+ SSL: Hold the right monitor while running delegating task
+ SSL: Execute SSL_do_handshake(...) after task is run to ensure
SSLEngine.getHandshakeStatus() returns the correct value all
the time
+ Add active flag to EpollServerDomainSocketChannel fd
constructor
+ Epoll: Fix possible Classloader deadlock caused by loading
class via JNI
+ Prefer /etc/resolv.conf on Linux and Mac
+ Handle invalid cookie value
+ Upgrade to latest tcnative release
+ ByteToMessageDecoder.channelReadComplete(...) does call read()
too often
+ Remove the lock usage in PoolArena#numPinnedBytes()
+ Fix x-www-form-urlencoded parsing for no-value key
(re-submission)
* Fixes of 4.1.107:
+ Speedup pseudoheader lookup
+ Add support for the Partitioned attribute in cookies
+ Reduce HTTP 1.1 Full msg pipeline traversals
+ DnsNameResolver: Add DnsQueryIdSpace class to reduce overhead
while generating IDs
+ Fix copy-paste mistake in
LazyX509Certificate.getIssuerAlternativeNames()
+ HTTP2: lastStreamCreated() does return the wrong value when
all stream ids were used
+ HTTP2: Update local window should not fail queued frames
+ DnsNameResolver: Allways call bind() during bootstrap
+ HTTP: HttpObjectDecoder must not use HTTPMessage once it is
passed to the next handler in the ChannelPipeline
+ Ensure key / values are shared between resumed sessions
+ SSLSession.getLastAccessedTime() and getCreationTime() should
not be equal when session is reused
+ Snappy: Use unsigned short to handle 2 ^ 16 input size instead
of 2 ^ 15
* Fixes of 4.1.106:
+ HTTP2: Prevent sharing the index of the continuation frame
header ByteBuf.
+ DnsNameResolver: Fail query if id space is exhausted
+ Short-circuit ByteBuf::release
* Fixes of 4.1.105:
+ Fix exception on HTTP chunk size overflow
+ Default value of MAX_MESSAGES_PER_READ not used for native
DatagramChannels
+ Redo fix scalability issue due to checkcast on context's
invoke operations
+ Be able to retry the query via TCP if a query failed because
of a timeout
+ Save HTTP 2 pseudo-header lower-case validation
+ DnsNameResolver: Limit connect timeout to query timeout
+ h2: propagate stream close without read pending, avoid SOOE
if !autoRead
* Fixes of 4.1.104:
+ dyld: Symbol not found: _netty_jni_util_JNI_OnLoad
* Fixes of 4.1.103:
+ Workaround for regex bug in Android SDK
+ Use Http2Headers.size() instead of isEmpty()
+ Add support for RISC-V
* Fixes of 4.1.101:
+ Add service-loaded extension points for channel initialization
+ Added check for pseudo-headers in trailers
+ Automatically close Http2StreamChannel when
Http2FrameStreamExceptionreaches end ofChannelPipeline
+ Throwing a stackless exception if RST_FRAME rate is exceeded
+ Only enable the RST limit for servers by default
+ Change default value of MAX_MESSAGES_PER_READ for
DatagramChannel implementations
+ Descriptive message for errors related to unknown http2
streams
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
+ rebase
* Wed Feb 21 2024 Gus Kenion <gus.kenion@suse.com>
- Use %patch -P N instead of deprecated %patchN.
* Thu Oct 12 2023 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.100
* Fixes of 4.1.100:
+ DDoS vector in the HTTP/2 protocol due RST frames
(bsc#1216169, CVE-2023-44487)
+ Do not fail when compressing empty HttpContent
* Fixes of 4.1.99:
+ Do not try to delete a global handle with the local handles
APIs
+ Enable build with JDK21
+ dyld: lazy symbol binding failed: Symbol not found:
_netty_jni_util_JNI_OnLoad
* Fixes of 4.1.98:
+ Revert "HttpHeaderValidationUtil should reject chars past the
1 byte range"
+ Filter out unresolved addresses when parsing resolv.conf
+ Prevent classloader leak via JNI
+ SSLSession.getPeerCertificateChain() should throw
UnsupportedOperationException if javax.security.cert
.X509Certificate can not be created
+ Enable client side session cache when using native SSL by
default
* Fixes of 4.1.97:
+ Fixing AsciiString#lastIndexOf To Respect The offset
+ Add support for snappy http2 content decompression
+ Add support for password-based encryption scheme 2 params
+ HttpHeaderValidationUtil should reject chars past the 1 byte
range
+ Honor SslHandler.setWrapDataSize greater than SSL packet
length
+ Add support for snappy http content encoding
* Fixes of 4.1.96:
+ Move the PoolThreadCache finalizer to a separate object
+ Fix kevent(..) failed: Invalid argument
+ Revert "Always increment Stream Id on createStream" to fix bug
which caused sending multiple RST frames for the same id
* Fixes of 4.1.95
+ Add resource leak listener
+ Reduce object allocations during SslHandler.flush(...)
+ Ensure ByteBuf.capacity(...) will never throw AssertionError
+ Make transport.Bootstrap usable with no netty-resolver on
classpath
+ Correctly retain slice when calling
ReplayingDecoderByteBuf.retainedSlice(...)
+ Always increment Stream Id on createStream(...)
+ Fix BrotliEncoder bug that does not mark ByteBuf it encodes a
read
+ Enhance CertificateException message when throw due hostname
validation
- Rebased patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
* Wed Sep 13 2023 Fridrich Strba <fstrba@suse.com>
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp
* Fri Jun 23 2023 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.94
* Fixes of 4.1.94:
+ Respect offset in
io.netty.util.NetUtil#toAddressString(byte[], int, boolean)
+ Skip finalization for PoolThreadCache instances without
small/normal caches
+ Use network byte order when encoding ipv4 address and port
for Socks codecs
+ Call ReleaseByteArrayElements even when handling of
socket_path fails to fix small mem leak
+ Always enable leak tracking for derived buffers if parent is
tracked
+ Release DnsRecords when failing to notify promise
+ Delay possibility to reuse transaction id when query is
failing because of timeout or cancellation
+ Implement contains for SelectedSelectionKeySet
+ Use Two-Way for finding the delimiter in
DelimiterBasedFrameDecoder
+ Obtain the local address from the fd when the client connects
only with remote address (UDS)
+ Allow to limit the maximum lenght of the ClientHello
(bsc#1212637, CVE-2023-34462)
* Fixes of 4.1.93:
+ Reset byte buffer in loop for AbstractDiskHttpData.setContent
+ OpenSSL MAX_CERTIFICATE_LIST_BYTES option supported
+ Adapt to DirectByteBuffer constructor in Java 21
+ HTTP/2 encoder: allow HEADER_TABLE_SIZE greater than
Integer.MAX_VALUE
+ Upgrade to latest netty-tcnative to fix memory leak
+ H2/H2C server stream channels deactivated while write still
in progress
+ Channel#bytesBefore(un)writable off by 1
+ HTTP/2 should forward shutdown user events to active streams
+ Respect the number of bytes read per datagram when using
recvmmsg
* Fixes of 4.1.92:
+ Make Recycler faster on OpenJ9
+ Allow to change the limit for the maximum size of the
certificate chain.
+ Guard against unbounded grow of suppressed exceptions storage
+ Release websocket handshake response if pipeline checks fail
+ Add support for local and remote addresses on the server for
child channels when UDS
+ Http types slow path checks
* Fixes of 4.1.91:
+ Fire a PrematureChannelClosureException when Channel is closed
while aggregating is still in progress
+ Connect without password if server returns NO_AUTH when using
Socks5
+ Use optional resolution of sun.net.dns
+ Introduce Http2MultiplexActiveStreamsException that can be
used to propagate an error to all active streams
+ Use the correct error when reset a stream
+ Update: Add snappy support on HttpContentDecoder
+ Don't unwrap multiple records until we notified the caller
about the finished handshake
+ Handle EHOSTUNREACH errors in io.netty.channel.unix.Errors
- Depend on netty-tcnative >= 2.0.60 for SSLContext.setMaxCertList
method.
- Rebased patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* 0004-Disable-Brotli-and-ZStd-compression.patch
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
* 0007-Do-not-require-the-tcnative-native-library.patch
* Thu Mar 30 2023 Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 4.1.90
* Fixes of 4.1.90:
+ Adding header name of the header which failed validation
+ Fix HttpHeaders.names for non-String headers
+ Save expensive volatile operations in the common hot http
decoder path
+ Avoid slow type checks against promises on outbound buffer's
progress
+ Implement NonStickyEventExecutorGroup.inEventLoop
+ Native image: add support for unix domain sockets
+ Use MacOS SDK 10.9 to prevent apple notarization failures
+ Increase errno cache and guard against IOOBE
+ Don't reset BCSSLParameters when setting application protocols
+ WebSocketClientProtocolHandler: add option to disable UTF8
validation
+ Chunked HTTP length decoding should account for
whitespaces/ctrl chars
+ Handle NullPointerException thrown from
NetworkInterface.getNetworkInterfaces()
* Fixes of 4.1.89:
+ Don't fail on HttpObjectDecoder's maxHeaderSize greater then
(Integer.MAX_VALUE - 2)
+ dyld: Symbol not found: _netty_jni_util_JNI_OnLoad when
upgrading from 4.1.87.Final to 4.1.88.Final
* Fixes of 4.1.88:
+ Speed-up HTTP 1.1 header and line parsing
+ Add StacklessSSLHandshakeException for ClosedChannelException
+ Modify changed CloseWebSocketFrame#statusCode() to change the
fetch code to unsigned
+ Check if CommandLineTools are installed before trying to
execute install_name_tool
+ Allow to adjust the GlobalEventExecutor quietPeriod via a
system property
+ Add SslProvider.isOptionSupported(...)
+ Fix FlowControlHandler's behaviour to pass read events when
auto-reading is turned off
+ Ensure Http2StreamFrameToHttpObjectCodec#decode doesn't add
transfer-encoding for 204/304 response
+ Only do extra CNAME query if we couldnt follow the whole CNAME
chain in the response
+ Include query id when a query failed
+ DnsResolveContext: include expected record types in exception
message
+ Add necessary native-image configuration files for epoll
+ Create a deep-copy of the Throwable before returning it from
the cache to prevent possible leaks
+ Always respect completeOncePreferredResolved in
DnsNameResolver
+ fix brotli compression
+ Optionally depend on bctls-jdk15on
+ Make releasing objects back to Recycler faster
+ Correctly keep track of validExtensions per request / response
+ Add handling of inflight lookups to reduce real queries when
lookup same hostname
+ DnsQueryContext: include query id and question info in
exception message
+ AsciiStrings can be batch-encoded
* Fixes of 4.1.87:
+ Upgrade to latest netty-tcnative release which doesnt link
libcrypt
+ Add recvmmsg & sendmmsg syscall number for loongarch64
+ Return correct value from SSLSession.getPacketSize() when
using native SSL implementation
+ Explicit disable TLSv1.3 in the OpenSSL options if not
supported
+ Support handshake timeout in SniHandler.
+ Extend DNS address supplier interface to provide feedback
* Fixes of 4.1.86:
+ HAProxyMessageDecoder Stack Exhaustion DoS (bsc#1206360,
CVE-2022-41881)
+ HTTP Response splitting from assigning header value iterator
(bsc#1206379, CVE-2022-41915)
+ Revert #12888 for potential task scheduling problems in
HashedWheelTimer
+ Deprecate ObjectEncoder/ObjectDecoder
+ HPACK dynamic table size update must happen at the beginning
of the header block
* Fixes of 4.1.85:
+ A bug in FlowControlHandler that broke auto-read has been
fixed
+ The HTTP/2 HPACK encoder is now faster at encoding headers
that have many values
+ A potential memory leak bug has been fixed in the pooled
allocator
+ Fix an issue with the Blockhound integration, which could
cause the MacOSDnsServerAddressStreamProvider to be flagged
as making blocking calls
+ Inconsitencies in how epoll, kqueue, and NIO handle RDHUP have
been fixed
+ ByteToMessageDecoder now handle situations where the same
ByteBuf instance is read multiple times
+ The check that ensures the HTTP/1 Content-Length header is
unique, now no longer causes headers to be rearranged (change
their order)
+ Fix a NullPointerException bug with class initialisation order
between InternalLogger and InternalThreadLocalMap
+ When the netty-resolver-dns-native-macos classes can't load
their native bindings, they now only print a short error
message instead of the huge stack trace it printed previously.
The stack trace is still included if DEBUG logging is enabled
+ The Graal native-image meta-data is now placed in the
recommended location, and no longer causes warnings to be
printed
+ The HTTP/1 and HTTP/2 codecs now properly support RFC 8297
Early Hints
+ Subclasses of FastThreadLocalThread can now tell the Netty
Blockhound integration that they should be allowed to make
blocking calls
+ Validation of HTTP/2 connection headers have been moved from
Http2Headers to HpackDecoder, so that outgoing headers are
not validated
* Fixes of 4.1.84:
+ HTTP/2 header values with invalid characters are now rejected
in header validation
+ We now automatically generate conditional meta-data for
native-image use, making GraalVM support more reliable
+ Fix a scalability issue caused by instanceof and check-cast
checks that lead to false-sharing on the
Klass::secondary_super_cache field in the JVM
(See JDK-8180450)
+ Made the HTTP/2 HPACK static table implementation faster by
using a perfect hash function
+ Fixed a bug in our PEMParser when PEM files have multiple
objects, and BouncyCastle is on the classpath
* Fixes of 4.1.82:
+ Fix a NullPointerException bug when calling forEachByte on
nested CompositeByteBufs
+ Relax an overly strict HTTP/2 header validation check that was
rejecting requests from Chrome and Firefox
+ The OpenSSL and BoringSSL implementations now respect the
jdk.tls.client.protocols and jdk.tls.server.protocols system
properties, making them react to these in the same way the JDK
SSL provider does
* Fixes of 4.1.81:
+ Fix a regression SslContext private key loading
+ Fix a bug in SslContext private key reading fall-back path
+ Fix a buffer leak regression in HttpClientCodec
+ Fix a bug where some HttpMessage implementations, that also
implement HttpContent, were not handled correctly
+ The MessageFormatter and FormattingTuple classes are now
usable in the public API
+ Connection related headers in HTTP/2 frames are now rejected,
in compliance with the specification
* Fixes of 4.1.80:
+ HttpObjectEncoder scalability issue due to instanceof checks
+ Improve logging when MacOSDnsServerAddressStreamProvider
cannot be found/loaded
+ Replace stdlib write/read with send/recv
+ Support for pkcs1
+ Add Blockhound exceptions for the PooledByteBufAllocator
+ Fix epoll bug when receiving zero-sized datagrams
+ Avoid including header values in header validation failure
exceptions
+ Avoid allocating large buffers in JdkZlibEncoder
+ Native Image Support: Set
IS_EXPLICIT_TRY_REFLECTION_SET_ACCESSIBLE to true by default
for native images
+ We need to use disconnectx(...) on macOS
+ Replace synchronized with Java Locks on the allocator
+ Don't use static instances of FixedRecvByteBufAllocator
+ Add escaping for stomp headers
* Fixes of 4.1.79:
+ The PEM certificate parser is no longer susceptible to
exponential back-off
+ Non-standard extra ampersands in HTTP POST bodies are no
longer rejected
+ An io.netty.osClassifiers system property has been added to
avoid reading os-release files
+ Fix a bug in SslHandler so handlerRemoved works properly even
if handlerAdded throws an exception
+ Use the correct OSGi processor directive on aarch64, making it
possible to use OSGi on ARM
+ HTTP paths that begin with a double-slash are now parsed the
same way browsers do
+ The isCompleted flag is now correctly preserved on objects
from HttpData.retainedDuplicate()
+ The HttpUtil.isOriginForm() and isAsteriskForm() methods now
correctly conform with RFC 7230
+ Fix an issue that allowed the multicast methods on
EpollDatagramChannel to be called outside of an event-loop
thread
+ Support for the LoongArch64 processor architecture has been
added
* Fixes of 4.1.78:
+ Fix a bug where an OPT record was added to DNS queries that
already had such a record
+ Fix a bug that caused an error when files uploaded with HTTP
POST contained a backslash in their name
+ Fix an issue in the BlockHound integration that could
occasionally cause NetUtil to be reported as performing
blocking operations
+ A similar BlockHound issue was fixed for the JdkSslContext
+ Fix a bug that prevented preface or settings frames from
being flushed, when an HTTP2 connection was established with
prior-knowledge
+ Fixes a rare NullPointerException that could occur when a
ReferenceCountedOpenSslEngine threw an OutOfMemoryError from
its constructor, and was then later finalized
+ The SslHandler now adds the socket file descriptor to the
BIOs, when the SslEngine supports this (boringssl and
libressl), which allow tracing and observability tools to
monitor encryption traffic on a per-connection basis.
+ It is now possible to explicitly step the scheduling clock in
EmbeddedEventLoop, which is useful for making automated tests
with deterministic scheduling
* Fixes of 4.1.77:
+ Local Information Disclosure Vulnerability in Netty on
Unix-Like systems due temporary files for Java 6 and lower in
io.netty:netty-codec-http (bsc#1199338, CVE-2022-24823)
+ Upgraded the optional netty-tcnative dependency to version
2.0.52.Final
+ Fix a bug where Netty fails to load a shaded native library
+ Include classifier in Automatic-Module-Name
+ Check if epoll_pwait2 is implemented
+ Don't call strdup on packagePrefix
+ Enable debugging of asynchronous tasks in Intellij
+ Throwing an exception in case glibc is missing instead of
segfaulting the JVM
* Fixes of 4.1.76:
+ Upgraded the optional netty-tcnative dependency to version
2.0.51.Final
+ Upgraded the optional log4j dependency to version 2.17.2
+ The netty-all module now declare an automatic module name,
making it useable with Java Modules.
+ It is now possible to configure arbitrary socket options for
the native epoll and kqueue transports. Refer to your
operating system documentation for what options are available.
+ It is now possible to explicitly bind channels to either IPv4
or IPv6.
+ The HTTP/2 header validation that rejects duplicate
pseudo-headers, which was added in 4.1.75.Final, has been
changed so it no longer breaks older versions of gRPC.
" Fix a NullPointerException that was hiding the real cause of
certain HTTP/2 header decoding errors.
- Modified patches:
* 0001-Remove-optional-dep-Blockhound.patch
* 0002-Remove-optional-dep-conscrypt.patch
* 0003-Remove-optional-deps-jetty-alpn-and-npn.patch
* no-brotli-zstd.patch
- > 0004-Disable-Brotli-and-ZStd-compression.patch
* no-werror.patch
+ rebase
- Removed patches:
* 0004-Remove-optional-dep-tcnative.patch
* 0005-Remove-optional-dep-log4j.patch
+ we have the dependencies, so no need to disable them
* 0006-revert-Fix-native-image-build.patch
* 0007-Revert-Support-session-cache-for-client-and-server-w.patch
+ solve the build breakages differently
- Added patches:
* 0005-Do-not-use-the-Graal-annotations.patch
* 0006-Do-not-use-the-Jetbrains-annotations.patch
+ do not use annotations for which we don't have dependencies
* 0007-Do-not-require-the-tcnative-native-library.patch
+ our tcnative library is installed system-wide
/usr/share/maven-metadata/netty-bom.xml /usr/share/maven-poms/netty /usr/share/maven-poms/netty/netty-bom.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Nov 9 23:33:15 2026