I'm happy to announce the first bug-fix release for our 4.1.x series today.

This release contains many bug-fixes and also one security bug-fix which was filled as CVE-2016-4970 and can lead to a DOS. Because of this security bugfix you should upgrade ASAP if you use our OpenSslEngine which is true if you have netty-tcnative on your classpath and openssl libraries installed on the system.

The most important changes are:

• OpenSslEngine writePlaintextData WANT_READ with no data in BIO buffer (#5364)
• Ensure the correct wrapped buffer is released in AbstractPooledDerivedByteBuf.deallocate() (#5347)

For the details and all changes, please browse our issue tracker.

As always, please let us know if you find any issues. We love feedback!

Thank You

Every idea and bug-report counts and so we thought it is worth mentioning those who helped in this area. Please report an unintended omission.

• @buchgr
• @lburgazzoli
• @normanmaurer
• @Scottmitch
• @trustin
• @vietj
• @windie