Netty Project

We are happy to announce the release of netty 4.1.138.Final. This is a bug-fix and security release. Note that Netty 4.1 will be End-of-Life on July 1st, 2027. We strongly recommend upgrading to this version to get the following security fixes: ... [More] CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http CVE-2026-XXXXX : unbounded resource usage... [Less]

We are happy to announce the release of netty 4.2.18.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-XXXXX : unbounded resource usage in ... [More] io.netty:netty-codec-http (SPDY) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded... [Less]

Netty 4.1.0.Final was released on May 26, 2016 — over 10 years ago. On April 3rd, 2025, we released Netty 4.2.0.Final to the world, and have since focused our feature work on this series, with only bug- and security-fixes being backported to the ... [More] 4.1 release series. Today we are announcing that Netty 4.1 will be End-of-Life on July 1st, 2027. After this date, we will no longer support Netty 4.1, and we will make no further releases in this series. All users and integrators are encouraged to upgrade to Netty 4.2. Please see our Netty 4.2 Migration Guide for help in this regard. Thank you to... [Less]

Netty 4.1.0.Final was released on May 26, 2016 — over 10 years ago. On April 3rd, 2025, we released Netty 4.2.0.Final to world, and have since focused our feature work on this series, with only bug- and security-fixes being backported to the 4.1 ... [More] release series. Today we are announcing that Netty 4.1 will be End-of-Life on July 1st, 2027. After this date, we will no longer support Netty 4.1, and we will make no further releases in this series. All users and integrators are encouraged to upgrade to Netty 4.2. Please see our Netty 4.2 Migration Guide for help in this regard. Thank you to everyone... [Less]

We are happy to announce the release of netty 4.1.137.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-XXXXX : algorithm inefficiency in ... [More] io.netty:netty-handler CVE-2026-XXXXX : improper NUL byte neutrolization in io.netty:netty-codec-socks CVE-2026-XXXXX : SNI bypass in io.netty:netty-handler CVE-2026-59902 : memory exhaustion in io.netty:netty-transport-sctp CVE-2026-59903 : cache poisoning & info disclosure in io.netty:netty-codec-http CVE-2026-XXXXX : validation bypass in io.netty:netty-codec-mqtt CVE-2026-XXXXX : improper hostname verification in io.netty:netty-handler Other significant changes are: Auto-port 4.1: AsciiString.cached(String) should sanitize the provided String (#13749) by @netty-project-bot in https://github.com/netty/netty/pull/17069 AsciiString.cached(String) should sanitize the provided String (#13749) (#17007) by @normanmaurer in https://github.com/netty/netty/pull/17075 Fix AsciiString.cached(String) performance regression (#17074)... [Less]

We are happy to announce the release of netty 4.2.17.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-XXXXX : algorithm inefficiency in ... [More] io.netty:netty-handler CVE-2026-XXXXX : improper NUL byte neutrolization in io.netty:netty-codec-socks CVE-2026-XXXXX : SNI bypass in io.netty:netty-handler CVE-2026-59902 : memory exhaustion in io.netty:netty-transport-sctp CVE-2026-59903 : cache poisoning & info disclosure in io.netty:netty-codec-http CVE-2026-XXXXX : validation bypass in io.netty:netty-codec-mqtt CVE-2026-XXXXX : improper hostname verification in io.netty:netty-handler Other significant changes are: AsciiString.cached(String) should sanitize the provided String #17007 Fix AsciiString.cached(String) performance regression #17074 SslHandler: Fix possible buffer leak when an OOME is thrown during allocation #17059 Add HttpContentCompressor constructor with ability to... [Less]

We are happy to announce the release of netty 4.2.16.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-XXXXX : algorithm inefficiency in ... [More] io.netty:netty-handler CVE-2026-XXXXX : improper NUL byte neutrolization in io.netty:netty-codec-socks CVE-2026-XXXXX : SNI bypass in io.netty:netty-handler CVE-2026-59902 : memory exhaustion in io.netty:netty-transport-sctp CVE-2026-59903 : cache poisoning & info disclosure in io.netty:netty-codec-http CVE-2026-XXXXX : validation bypass in io.netty:netty-codec-mqtt CVE-2026-XXXXX : improper hostname verification in io.netty:netty-handler Other significant changes are: AsciiString.cached(String) should sanitize the provided String #17007 Fix AsciiString.cached(String) performance regression #17074 SslHandler: Fix possible buffer leak when an OOME is thrown during allocation #17059 Add HttpContentCompressor constructor with ability to... [Less]

We are happy to announce the release of netty 4.1.136.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-XXXXX: memory exhaustion in ... [More] io.netty:netty-codec-stomp. CVE-2026-55833: zip bomb in io.netty:netty-codec-http. CVE-2026-XXXXX: improper CR/LF neutrolization in io.netty:netty-codec-http (multipart). CVE-2026-XXXXX: improper CR/LF neutrolization in io.netty:netty-codec-haproxy. CVE-2026-55851: memory exhaustion in io.netty:netty-codec-haproxy. CVE-2026-56745: memory exhaustion in io.netty:netty-codec-http. CVE-2026-56817: insecure defaults in XML parsing in io.netty:netty-codec-xml. CVE-2026-XXXXX: memory exhaustion in io.netty:netty-codec-http. CVE-2026-56818: memory leak in io.netty:netty-codec-redis. CVE-2026-56819: memory leak in io.netty:netty-codec-http2. CVE-2026-55831: resource exhaustion/DoS in io.netty:netty-codec-http. CVE-2026-XXXXX: memory leak in io.netty:netty-codec-dns. CVE-2026-XXXXX: infinite loop in io.netty:netty-codec-compression (bzip2). CVE-2026-XXXXX: improper header neutralization in io.netty:netty-codec-http2. CVE-2026-XXXXX: protocol version confusion in io.netty:netty-codec-http (websocket). CVE-2026-56746: improper... [Less]

We are happy to announce the release of netty 4.1.136.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-44891: memory exhaustion in ... [More] io.netty:netty-codec-stomp. CVE-2026-55833: zip bomb in io.netty:netty-codec-http. CVE-2026-59921: improper CR/LF neutrolization in io.netty:netty-codec-http (multipart). CVE-2026-59919: improper CR/LF neutrolization in io.netty:netty-codec-haproxy. CVE-2026-55851: memory exhaustion in io.netty:netty-codec-haproxy. CVE-2026-56745: memory exhaustion in io.netty:netty-codec-http. CVE-2026-56817: insecure defaults in XML parsing in io.netty:netty-codec-xml. CVE-2026-59899: memory exhaustion in io.netty:netty-codec-http. CVE-2026-56818: memory leak in io.netty:netty-codec-redis. CVE-2026-56819: memory leak in io.netty:netty-codec-http2. CVE-2026-55831: resource exhaustion/DoS in io.netty:netty-codec-http. CVE-2026-XXXXX: memory leak in io.netty:netty-codec-dns. CVE-2026-59901: infinite loop in io.netty:netty-codec-compression (bzip2). CVE-2026-59900: improper header neutralization in io.netty:netty-codec-http2. CVE-2026-59898: protocol version confusion in io.netty:netty-codec-http (websocket). CVE-2026-56746: improper... [Less]

We are happy to announce the release of netty 4.2.16.Final. This is a bug-fix and security release. We strongly recommend upgrading to this version to get the following security fixes: CVE-2026-44891: memory exhaustion in ... [More] io.netty:netty-codec-stomp. CVE-2026-55833: zip bomb in io.netty:netty-codec-http. CVE-2026-59921: improper CR/LF neutrolization in io.netty:netty-codec-http (multipart). CVE-2026-59919: improper CR/LF neutrolization in io.netty:netty-codec-haproxy. CVE-2026-55851: memory exhaustion in io.netty:netty-codec-haproxy. CVE-2026-56745: memory exhaustion in io.netty:netty-codec-http. CVE-2026-56817: insecure defaults in XML parsing in io.netty:netty-codec-xml. CVE-2026-59899: memory exhaustion in io.netty:netty-codec-http. CVE-2026-56818: memory leak in io.netty:netty-codec-redis. CVE-2026-56819: memory leak in io.netty:netty-codec-http2. CVE-2026-56816: memory exhaustion in io.netty:netty-codec-http3. CVE-2026-55831: resource exhaustion/DoS in io.netty:netty-codec-http. CVE-2026-XXXXX: memory leak in io.netty:netty-codec-dns. CVE-2026-59901: infinite loop in io.netty:netty-codec-compression (bzip2). CVE-2026-59900: improper header neutralization in io.netty:netty-codec-http2. CVE-2026-59898: protocol version confusion... [Less]