We are happy to announce the release of netty 4.1.138.Final. This is a bug-fix and security release.

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

Other significant changes are:

• Use X509ExtendedTrustManager in SSLErrorTest #17224
• Validate chunked-must-be-last regardless of HTTP version #17228
• Update junit version #17233
• Add system property to disable RFC 6761 localhost resolution #17230
• Update setup-testlens to v1.9.4 (#17223) #17229
• Adjust failsafe plugin version to be in sync with surefire plugin #17241
• Release unsent LastHttpContent in HttpChunkedInput #17251
• HTTP/2: Release compressors after failed headers writes #17265
• HTTP/2: Prevent reentrant flush on writability change #17268
• Respect max messages per read in LocalServerChannel (#17255) #17269
• HTTP: Preserve encoder state after header encoding failures #17275
• Bzip2: Correctly detect overflow during block size bound check (#17261) #17273
• HTTP/2: Drain queued frames stranded by a writability change during flush #17280
• Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator #17282
• Extract Bootstrap and ServerBootstrap setup to a common method (#15134) #17289
• Release channel when FixedChannelPool acquire is cancelled (#17287) #17291
• HTTP: Release content encoder after header mutation failure #17294
• Add a script that can download GHSA vulnerability reports #17302
• FileRegion: Remove outdated JDK upgrade warning #17311
• codec-dns: Fix query OPCODE bit offset and mask #17316
• Install patchelf as part of awslc docker image generation #17322
• POOL: Close active unhealthy channels on release #17319
• Update to use graal 21 #17327
• Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test #17329
• Fix graal docker file usage #17333
• codec-dns: Report and allow setting full 16-bit EDNS(0) flags field #17332
• Kqueue: Continue reading when EOF is received before notify about channel inactivity #17309
• Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) #17338
• Increase timeout in test to address flakyness #17345
• DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky #17347
• Close Channel when connect is cancelled during resolution (#17321) #17349
• Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases #17351
• Http2: Cleanup child channel method signatures #17355
• Update to latest netty-tcnative release #17361
• Update to latest netty-jni-util release #17365
• Fix JdkZlibDecoder silently truncating highly compressible streams #17364
• ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough #17369
• Update to latest netty tcnative version #17398
• Security fixes #17403

For more details please see the complete release notes.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

• @chrisvest
• @normanmaurer
• @renechoi