Skip navigation

Netty 4.2.18.Final released

by chrisvest
on

We are happy to announce the release of netty 4.2.18.Final. This is a bug-fix and security release.

We strongly recommend upgrading to this version to get the following security fixes:

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

Other significant changes are:

  • Use X509ExtendedTrustManager in SSLErrorTest #17221
  • Validate chunked-must-be-last regardless of HTTP version #17055
  • Add system property to disable RFC 6761 localhost resolution #17100
  • Use VarHandle JCTools queues without Unsafe #17185
  • Fix NPE in AbstractNioChannel.removeReadOp() after concurrent deregistration #17104
  • Fix codec-native-quic published POM packaging #17235
  • http3: marshal QPACK resume/drain to stream event loop (fixes #17234) #17232
  • Release unsent LastHttpContent in HttpChunkedInput #17240
  • Ensure OCSP is also tested with out native implementation #17220
  • QUIC: Delete local references as soon as possible in the JNI layer #17258
  • Decouple QUIC token validation from ODCID derivation #17035
  • HTTP/2: Release compressors after failed headers writes #17253
  • HTTP/2: Prevent reentrant flush on writability change #17266
  • Respect max messages per read in LocalServerChannel #17255
  • Bzip2: Correctly detect overflow during block size bound check #17261
  • HTTP: Preserve encoder state after header encoding failures #17271
  • HTTP/2: Drain queued frames stranded by a writability change during flush #17279
  • OSCP: Add clock skew tolerance to OcspServerCertificateValidator #17277
  • Release channel when FixedChannelPool acquire is cancelled #17287
  • HTTP: Release content encoder after header mutation failure #17292
  • FileRegion: Remove outdated JDK upgrade warning #17308
  • codec-dns: Fix query OPCODE bit offset and mask #17314
  • POOL: Close active unhealthy channels on release #17306
  • QPACK: Correctly encode varint even when remainder is 128 #17310
  • codec-dns: Report and allow setting full 16-bit EDNS(0) flags field #17325
  • Protobuf: Update protobuf-javanano to non alpha release #17330
  • Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) #17105
  • io_uring: do not release write memory that the kernel still owns #17238
  • Close Channel when connect is cancelled during resolution #17321
  • Http2: Cleanup child channel method signatures #17350
  • QPACK: Only call firstByteEquals(...) when we actually have readables bytes in decodeLiteralValue(...) #17352
  • Make the Linux codec-native-quic artifacts loadable on musl (Alpine) #17348
  • ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough #17357
  • IoUring: Expose tcp_info #17354
  • Fix JdkZlibDecoder silently truncating highly compressible streams #17370
  • QUIC: Add missing NULL checks in native code to handle gracefully OOM #17378
  • Fix JZlibDecoder truncating highly compressible streams #17392
  • Update quiche to 0.29.2 #17393
  • Security fixes #17402

For more details please see the complete release notes.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.