Netty 4.2.17.Final released

by chrisvest
on 04-Aug-2026

We are happy to announce the release of netty 4.2.16.Final. This is a bug-fix and security release.

We strongly recommend upgrading to this version to get the following security fixes:

CVE-2026-XXXXX : algorithm inefficiency in io.netty:netty-handler
CVE-2026-XXXXX : improper NUL byte neutrolization in io.netty:netty-codec-socks
CVE-2026-XXXXX : SNI bypass in io.netty:netty-handler
CVE-2026-59902 : memory exhaustion in io.netty:netty-transport-sctp
CVE-2026-59903 : cache poisoning & info disclosure in io.netty:netty-codec-http
CVE-2026-XXXXX : validation bypass in io.netty:netty-codec-mqtt
CVE-2026-XXXXX : improper hostname verification in io.netty:netty-handler

Other significant changes are:

AsciiString.cached(String) should sanitize the provided String #17007
Fix AsciiString.cached(String) performance regression #17074
SslHandler: Fix possible buffer leak when an OOME is thrown during allocation #17059
Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth #17068
IoUring: preserve readPending when rescheduling canceled reads #17087
Reject negative maxOrder in PooledByteBufAllocator #17093
Fix AdaptiveByteBuf._setLongLE calling checked setLongLE #17098
Snappy: Guard decoder against invalid chunk lengths #17099
Update to latest netty-tcnative release #17056
Use safe decompressor in Lz4FrameDecoder #17118
IoUring: add SO_INQ support for Unix domain sockets #17127
fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding #17117
Codec-compression: Add decompressor API #16745
Codec-compression: Add Bzip2Decompressor #17145
Fix buddy cache evicting chunks with live buffers #17154
Codec-compression: Add Snappy frame decompressor #17153
Codec-compression: Add zlib decompressors #17155
Codec-compression: Add Zstd decompressor #17152
Codec-compression: Add LZF decompressor #17147
Codec-compression: Add BrotliDecompressor #17146
Codec-compression: Add Lz4FrameDecompressor #17148
HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding #17089
Fix direct memory OOM on low-core containers #17166
IoUring: Fix the recvmmsg emulation #17187
Avoid classloader leak via GlobalEventExecutor terminationFuture failure #17140
BrotliEncoder: Prevent duplicate close scheduling #17175
Fix JdkZlibDecompressor losing the tail of highly compressible streams #17191
Update compress-lzf to 1.2.1 #17194
Do not write WebSocket handshake response to the tail of the pipeline #17192
HttpServerCodec: do not consume the method queue for 1xx interim responses #17182
Weakly reference engines from the OpenSSL engine map #17199
OpenSSL: Allow to obtain used named group via OpenSslSession #17058

For more details please see the complete release notes.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.