Skip navigation

Netty 4.1.140.Final released

by chrisvest
on

We are happy to announce the release of Netty 4.1.140.Final. This is a bug-fix and security release.

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

Other significant changes are:

  • Reject Redis lines that start with LF #17806
  • Do not let a negatively cached search domain shadow a positive one #17805
  • Choose server key types from client's signature algorithms for TLS 1.3 #17809
  • LocalChannel: Deliver data written by the peer before it closed #17815
  • Validate padding of HEADERS frames without priority #17819
  • Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing #17822
  • Preserve invalid SNI names in ReferenceCountedOpenSslEngine #17824
  • Optimize redundant bounds checking in ByteBuf.setBytes #17827
  • Release the DNS response when a query future loses a cancel race #17828
  • Fix HpackDynamicTable losing entries when filled to capacity #17846
  • Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address #17842
  • Handle ed25519 and ed448 names in SignatureAlgorithmConverter #17850
  • HAProxyMessage: validate the length of all TLV types #17845
  • Validate bzip2 Huffman code lengths before building decode tables #17855
  • Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders #17854
  • Fix typos in comments/javadoc #17863
  • HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers #17860
  • Throw DecompressionException on JdkZlib preset dictionary mismatch #17864
  • Apply certificate list size floor #17861
  • Reject HTTP version numbers that overflow int #17859
  • HAProxyMessage: decode TLVs with an empty value at the end of the header #17877
  • Honor maxAllocation for brotli in DelegatingDecompressorFrameListener #17881
  • Reject invalid content-length in PUSH_PROMISE with a stream error #17875
  • HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index #17882
  • Skip JNDI nameserver lookup on IBM i #17892
  • Reset the h2c upgrade stream if the request can not be converted #17893
  • Fix NPE in Http2FrameCodec when h2c upgrade fails #17899
  • Don't size ZstdDecoder output buffers from the frame content size #17900
  • Don't lose frames when a delimiter is split across reads #17909
  • Read SOCKS5 length octets unsigned in the legacy socks decoders #17916
  • Fix truncated output in Brotli decoders #17923
  • Port: Wrap trailing ';' in Content-Disposition as ErrorDataDecoderException #17931
  • Kqueue: Deregister filters before closing the fd to avoid hitting a reused fd #17939
  • Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on activation #17935
  • Accept empty non-final fragments in PerMessageDeflateEncoder #17953
  • HTTP/2: Don't pass the close promise to a deferred close #17959
  • Fix endless value iterators in ReadOnlyHttpHeaders #17978
  • Don't drop the last character in AsciiString.trim(CharSequence) #17993
  • Fix the region copied by Unpooled.copiedBuffer(CharSequence, int, int, Charset) #17995
  • Add HpackDecoder test for non-token HTTP/2 header names #17992
  • Fix AsciiString.contains(...) false negatives after a partial match #17986
  • Treat DATA frames on reserved HTTP/2 streams as a connection error #17998
  • Reject reply codes with non-digit characters in SmtpResponseDecoder #18005
  • Don't loop forever in AbstractDiskHttpData when the file is short #18004
  • Http2: reject generic frames whose payload exceeds SETTINGS_MAX_FRAME_SIZE #18000
  • Return null or the default from read-only headers for invalid values #18017
  • Check the second gzip magic byte in JdkZlibDecoder #18007
  • Fix server-initiated WebSocket close handshake failing with "promise already done" #18032
  • Fix Snappy.encode(...) for input with a non-zero reader index #18031
  • MqttEncoder: Reject Variable Byte Integers larger than 268435455 #18025
  • Only delete socket files when binding and closing UDS channels #18044
  • Return the haystack's reader index from ByteBufUtil.indexOf(...) for an empty needle #18082
  • Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII bytes #18083
  • Fail to encode DNS messages that are too large for TCP #18081
  • Don't return an entry twice when removing while iterating a primitive map #18087
  • Mark disk-based HttpData as completed after setting empty content #18088
  • Fix out-of-bounds read when validating UDS paths in the native code #18016
  • Release a SPDY DATA frame that exceeds the session window #18094
  • Send zero-length datagrams instead of dropping or duplicating them #18107
  • Reject request-only and response-only pseudo-headers in invalid contexts (RFC 9113) #18113
  • Read all pending data when the EOF is received before the connect is complete in kqueue #18116
  • Read the 4 byte Snappy literal length as unsigned #18120
  • Deliver all data a LocalChannel peer wrote before it closed #18128
  • Close an HTTP/2 stream only after its last merged DATA frame was written #18144
  • Use IP_MULTICAST_IF in leaveGroup and block without an interface #18152
  • Don't lose the alert when the handshake fails in ReferenceCountedOpen… #18157
  • Send bad_certificate alert when the TrustManager rejects the certificate #18181
  • SslHandler: Size the unwrap output buffer for the plaintext, not the record #18182
  • Add opt-in Origin validation to WebSocketServerProtocolHandler (hardening) #18184
  • Fix reporting of the wrong error when setting flags on an accepted fd fails #18196
  • Epoll: Verify the FileChannel is a FileChannelImpl before reading its fd #18190
  • KQueue: Verify the FileChannel is a FileChannelImpl before reading its fd #18191
  • Do not send uninitialized stack memory when sending a fd over a domain socket #18197
  • Fix read of uninitialized memory when accepting a connection on a domain socket #18195
  • Epoll: Fix signed integer overflow when calculating the epoll_wait timeout #18194
  • Fix underflow detection in netty_unix_util_timespec_subtract_ns #18193
  • Don't encode Snappy copies with an offset that does not fit into 16 bits #18224
  • Don't truncate binary memcache key and extras lengths #18225
  • Update to latest netty-tcnative release #18236
  • Security fixes #18238

For more details please see the complete release notes.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.