Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled.
Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default.
HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in #17221
• Update setup-testlens to v1.9.4 by @marcphilipp in #17223
• Update lz4-java to 1.11.2 by @yawkat in #17222
• Validate chunked-must-be-last regardless of HTTP version by @husseinvr97 in #17055
• Add system property to disable RFC 6761 localhost resolution by @BoxJReilly in #17100
• Use VarHandle JCTools queues without Unsafe by @arnabnandy7 in #17185
• Adjust failsafe plugin version to be in sync with surefire plugin by @normanmaurer in #17236
• Fix NPE in AbstractNioChannel.removeReadOp() after concurrent deregistration by @seonwooj0810 in #17104
• Fix codec-native-quic published POM packaging by @arnabnandy7 in #17235
• http3: marshal QPACK resume/drain to stream event loop (fixes #17234) by @arnabnandy7 in #17232
• Release unsent LastHttpContent in HttpChunkedInput by @Gimini-3 in #17240
• Ensure OCSP is also tested with out native implementation by @normanmaurer in #17220
• QUIC: Delete local references as soon as possible in the JNI layer by @normanmaurer in #17258
• Decouple QUIC token validation from ODCID derivation by @Zhengcy05 in #17035
• HTTP/2: Release compressors after failed headers writes by @Gimini-3 in #17253
• HTTP/2: Prevent reentrant flush on writability change by @arnabnandy7 in #17266
• Respect max messages per read in LocalServerChannel by @Gimini-3 in #17255
• Bzip2: Correctly detect overflow during block size bound check by @normanmaurer in #17261
• HTTP: Preserve encoder state after header encoding failures by @Gimini-3 in #17271
• HTTP/2: Drain queued frames stranded by a writability change during flush by @bryce-anderson in #17279
• OSCP: Add clock skew tolerance to OcspServerCertificateValidator by @chrisvest in #17277
• Release channel when FixedChannelPool acquire is cancelled by @Gimini-3 in #17287
• HTTP: Release content encoder after header mutation failure by @Gimini-3 in #17292
• Correctly mark org.jctools:jctools-core-jdk11 as non optional by @normanmaurer in #17263
• Update flatten plugin and use flattenDependecyMode direct by @normanmaurer in #17296
• Add a script that can download GHSA vulnerability reports by @chrisvest in #17297
• FileRegion: Remove outdated JDK upgrade warning by @arnabnandy7 in #17308
• codec-dns: Fix query OPCODE bit offset and mask by @hyperxpro in #17314
• POOL: Close active unhealthy channels on release by @Gimini-3 in #17306
• QPACK: Correctly encode varint even when remainder is 128 by @normanmaurer in #17310
• Install patchelf as part of awslc docker image generation by @normanmaurer in #17317
• Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @normanmaurer in #17313
• codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @hyperxpro in #17325
• Protobuf: Update protobuf-javanano to non alpha release by @normanmaurer in #17330
• Port EOF handling test by @normanmaurer in #17336
• Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch...

Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility note

HTTP/2 header value validation is now enabled by default.
HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now.
Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by @netty-project-bot in #17224
• Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by @netty-project-bot in #17228
• Update junit version by @normanmaurer in #17233
• Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by @netty-project-bot in #17230
• Update setup-testlens to v1.9.4 (#17223) by @chrisvest in #17229
• Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by @netty-project-bot in #17241
• Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by @netty-project-bot in #17251
• Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by @netty-project-bot in #17265
• Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by @netty-project-bot in #17268
• Respect max messages per read in LocalServerChannel (#17255) by @normanmaurer in #17269
• Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by @netty-project-bot in #17275
• Bzip2: Correctly detect overflow during block size bound check (#17261) by @normanmaurer in #17273
• Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by @netty-project-bot in #17280
• Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by @normanmaurer in #17282
• Extract Bootstrap and ServerBootstrap setup to a common method (#15134) by @normanmaurer in #17289
• Release channel when FixedChannelPool acquire is cancelled (#17287) by @normanmaurer in #17291
• Auto-port 4.1: HTTP: Release content encoder after header mutation failure by @netty-project-bot in #17294
• Auto-port 4.1: Add a script that can download GHSA vulnerability reports by @netty-project-bot in #17302
• Auto-port 4.1: FileRegion: Remove outdated JDK upgrade warning by @netty-project-bot in #17311
• Auto-port 4.1: codec-dns: Fix query OPCODE bit offset and mask by @netty-project-bot in #17316
• Auto-port 4.1: Install patchelf as part of awslc docker image generation by @netty-project-bot in #17322
• Auto-port 4.1: POOL: Close active unhealthy channels on release by @netty-project-bot in #17319
• Update to use graal 21 by @normanmaurer in #17327
• Auto-port 4.1: Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @netty-project-bot in #17329
• Fix graal docker file usage by @normanmaurer in #17333
• Auto-port 4.1: codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @netty-project-bot in #17332
• Kqueue: Continue reading when EOF is received before notify about channel inactivity by @normanmaurer in #17309
• Auto-port 4.1: Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @netty-project-bot in #17338
• Auto-port 4.1: Increase timeout in test to address flakyness by @netty-project-bot in #17345
• Auto-port 4.1: DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @netty-project-bot in #17347
• Close Channel when connect is cancelled during resolution (#17321) by @normanmaurer in #17349
• Auto-port 4.1: Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @netty-project-bot in #17351
• Auto-port 4.1: Http2: Cleanup child channel method signatures by @netty-project-bot in #17355
• Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in #17361
• Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in #17365
• Fix JdkZlibDecoder silently truncating highly compressible streams by @renechoi in #17364
• Auto-port 4.1: ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @netty-project-bot in #17369
• Auto-port 4.1: Update to latest netty tcnative version by @netty-project-bot in #17398
• Bulk merge for 4.1 by @normanmaurer in #17403

Full Changelog: netty-4.1.137.Final...netty-4.1.138.Final

Pre-build clang to use for centos7

What's Changed

• Auto-port 4.1: AsciiString.cached(String) should sanitize the provided String (#13749) by @netty-project-bot in #17069
• AsciiString.cached(String) should sanitize the provided String (#13749) (#17007) by @normanmaurer in #17075
• Fix AsciiString.cached(String) performance regression (#17074) by @normanmaurer in #17080
• Auto-port 4.1: SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by @netty-project-bot in #17078
• Fix AsciiString.cached(String) performance regression (#17074) by @normanmaurer in #17083
• Auto-port 4.1: Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by @netty-project-bot in #17085
• Auto-port 4.1: Fix AdaptiveByteBuf._setLongLE calling checked setLongLE by @netty-project-bot in #17102
• Auto-port 4.1: Reject negative maxOrder in PooledByteBufAllocator by @netty-project-bot in #17095
• Auto-port 4.1: Snappy: Guard decoder against invalid chunk lengths by @netty-project-bot in #17110
• Backport #16079 and #17114 by @hyperxpro in #17134
• Auto-port 4.1: Use safe decompressor in Lz4FrameDecoder by @netty-project-bot in #17121
• Auto-port 4.1: Configure TestLens for the PR builds by @netty-project-bot in #17133
• Fix maxAllocation for brotli-encoded content in HttpContentDecompress… by @chrisvest in #17124
• Propagate the CI envionment variables through to the docker builds (#… by @chrisvest in #17143
• Auto-port 4.1: fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by @netty-project-bot in #17137
• Fix buddy cache evicting chunks with live buffers (#17154) by @franz1981 in #17176
• Auto-port 4.1: Avoid classloader leak via GlobalEventExecutor terminationFuture failure by @netty-project-bot in #17189
• Auto-port 4.1: HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding by @netty-project-bot in #17178
• BrotliEncoder: Prevent duplicate close scheduling (#17175) by @normanmaurer in #17193
• Auto-port 4.1: Update compress-lzf to 1.2.1 by @netty-project-bot in #17197
• Do not write WebSocket handshake response to the tail of the pipeline (#17192) by @normanmaurer in #17200
• HttpServerCodec: do not consume the method queue for 1xx interim responses (#17182) by @normanmaurer in #17203
• Adaptive allocator backports by @chrisvest in #17206
• Weakly reference engines from the OpenSSL engine map (#17199) by @chrisvest in #17205
• Auto-port 4.1: Add .editorconfig to enforce consistent coding style by @netty-project-bot in #17209
• Update surefire plugin to latest version (#17210) by @normanmaurer in #17212
• Update to latest netty-tcnative release (#17056) by @chrisvest in #17122
• Merge changes from forks (#17213) by @normanmaurer in #17217

Full Changelog: netty-4.1.136.Final...netty-4.1.137.Final

What's Changed

• AsciiString.cached(String) should sanitize the provided String (#13749) by @vpelikh in #17007
• Fix deploy workflow by @normanmaurer in #17071
• Fix AsciiString.cached(String) performance regression by @dreamlike-ocean in #17074
• SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by @normanmaurer in #17059
• Avoid leak presence detector in leak profile by @yawkat in #17073
• Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by @reta in #17068
• IoUring: preserve readPending when rescheduling cancelled reads by @dreamlike-ocean in #17087
• Reject negative maxOrder in PooledByteBufAllocator by @coderbruis in #17093
• Fix AdaptiveByteBuf._setLongLE calling checked setLongLE by @franz1981 in #17098
• Snappy: Guard decoder against invalid chunk lengths by @yawkat in #17099
• Fix OCSP Tests by @chrisvest in #17114
• Update to latest netty-tcnative release by @normanmaurer in #17056
• Use safe decompressor in Lz4FrameDecoder by @yawkat in #17118
• Configure TestLens for the PR builds by @chrisvest in #17129
• IoUring: add SO_INQ support for Unix domain sockets by @dreamlike-ocean in #17127
• fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by @ChunMengLu in #17117
• Propagate the CI envionment variables through to the docker builds by @chrisvest in #17138
• Codec-compression: Add decompressor API by @yawkat in #16745
• Fix silent failures and optimize error short-circuit in multi-threaded tests by @rajan-github in #17106
• Codec-compression: Add Bzip2Decompressor by @yawkat in #17145
• Fix buddy cache evicting chunks with live buffers by @franz1981 in #17154
• Codec-compression: Add Snappy frame decompressor by @yawkat in #17153
• Codec-compression: Add zlib decompressors by @yawkat in #17155
• Codec-compression: Add Zstd decompressor by @yawkat in #17152
• Codec-compression: Add LZF decompressor by @yawkat in #17147
• Codec-compression: Add BrotliDecompressor by @yawkat in #17146
• Codec-compression: Add Lz4FrameDecompressor by @yawkat in #17148
• HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding by @HwangRock in #17089
• Fix direct memory OOM on low-core containers by @franz1981 in #17166
• IoUring: Fix the recvmmsg emulation by @dreamlike-ocean in #17187
• Avoid classloader leak via GlobalEventExecutor terminationFuture failure by @seonwooj0810 in #17140
• BrotliEncoder: Prevent duplicate close scheduling by @yawkat in #17175
• Fix JdkZlibDecompressor losing the tail of highly compressible streams by @renechoi in #17191
• Update compress-lzf to 1.2.1 by @yawkat in #17194
• Do not write WebSocket handshake response to the tail of the pipeline by @el-psy-kongroo-d in #17192
• HttpServerCodec: do not consume the method queue for 1xx interim responses by @HwangRock in #17182
• Weakly reference engines from the OpenSSL engine map by @bryce-anderson in #17199
• OpenSSL: Allow to obtain used named group via OpenSslSession by @normanmaurer in #17058
• Add .editorconfig to enforce consistent coding style by @vpelikh in #17052
• Update surefire plugin to latest version by @normanmaurer in #17210
• Merge changes from forks by @chrisvest in #17213

New Contributors

• @vpelikh made their first contribution in #17007
• @ChunMengLu made their first contribution in #17117
• @rajan-github made their first contribution in #17106
• @seonwooj0810 made their first contribution in #17140
• @renechoi made their first contribution in #17191
• @el-psy-kongroo-d made their first contribution in #17192

Full Changelog: netty-4.2.16.Final...netty-4.2.17.Final

What's Changed

• SingleThreadEventExecutor: document Throwable safety contract on run() by @daguimu in #16814
• Make HTTP/2 frame hashCode consistent with equals by @daguimu in #16692
• Add BlockHound exception for DnsQueryIdSpace (#16896) by @chrisvest in #16915
• FlowControlHandler: Fix autoRead behavior by @chrisvest in #16912
• Auto-port 4.1: Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by @netty-project-bot in #16911
• MQTT: Fix MQTT decoder size check after variable header replay by @daguimu in #16916
• MQTT: Make the decodeProperties early-REPLAY check actually fire by @daguimu in #16813
• Reject control characters at the boundary of HTTP method names (#16723) by @chrisvest in #16933
• Auto-port 4.1: Update to latest tcnative release by @netty-project-bot in #16941
• Auto-port 4.1: Fix HTTP 2 PUSH_PROMISE stream association validation by @netty-project-bot in #16955
• Auto-port 4.1: Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by @netty-project-bot in #16957
• Auto-port 4.1: Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by @netty-project-bot in #16964
• Strictly validate MQTT UTF-8 Encoded String (#16939) by @chrisvest in #16965
• Auto-port 4.1: Stop DateFormatter trailing token from running past the parse end by @netty-project-bot in #16968
• Auto-port 4.1: IpFilter: Deprecate constructor which use accept by default by @netty-project-bot in #16973
• Add RFC 10008 QUERY Method support (#16966) by @normanmaurer in #16978
• Correctly release and fail queued traffic-shaping writes on close (#16959) by @normanmaurer in #16976
• Auto-port 4.1: FlowControlHandler: respect auto-read when toggled while dequeueing by @netty-project-bot in #16983
• IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982) by @chrisvest in #16989
• Auto-port 4.1: Fix typo in AbstractSniHandler Javadoc by @netty-project-bot in #16995
• Auto-port 4.1: Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by @netty-project-bot in #16997
• Reject control characters at the boundary of the HTTP version token (#16971) by @normanmaurer in #16986
• Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder by @netty-project-bot in #17003
• Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goaway by @netty-project-bot in #17017
• FastLz: Guard decompression against truncated input (#17000) by @chrisvest in #17015
• Backport 4.1 Fix propagation of startTls for client SslContext handler by @skyguard1 in #17020
• Auto-port 4.1: Reject non-token characters in HTTP/2 header names by @netty-project-bot in #17022
• Update lz4-java to 1.11.1 by @yawkat in #17060
• Pin github actions to reduce risk (#17043) by @normanmaurer in #17044
• Merge branches from forks (#17063) by @normanmaurer in #17065

Full Changelog: netty-4.1.135.Final...netty-4.1.136.Final

What's Changed

• Document Java 9 requirement for io_uring by @jchambers in #16904
• Add BlockHound exception for DnsQueryIdSpace by @violetagg in #16896
• Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by @skyguard1 in #16901
• Add epoch-based chunk cache purge with ring buffer for thread-local reuse by @franz1981 in #16766
• Use Splittable/ThreadLocalRandom to generate bulk data in tests by @chrisvest in #16808
• Auto-port 4.2: SingleThreadEventExecutor: document Throwable safety contract on run() by @netty-project-bot in #16909
• Auto-port 4.2: Make HTTP/2 frame hashCode consistent with equals by @netty-project-bot in #16910
• Auto-port 4.2: MQTT: Make the decodeProperties early-REPLAY check actually fire by @netty-project-bot in #16919
• IoUring: fix io_uring datagram writes with non-zero readerIndex by @dreamlike-ocean in #16905
• Exclude internal events from IoHandler.run() return value in epoll, io_uring and kqueue by @franz1981 in #16848
• IoUring: Pass IORING_ENTER_NO_IOWAIT to report accurate CPU usage by @wineway in #16739
• Avoid logging exceptions that tests ignore by @chrisvest in #16891
• Reject control characters at the boundary of HTTP method names by @daguimu in #16723
• IoUring: fix TCP Fast Open initial writes with readerIndex and composites by @dreamlike-ocean in #16929
• Try to fix/stabilize a number of flaky tests by @chrisvest in #16934
• Fix propagation of startTls for client SslContext handlers by @skyguard1 in #16931
• Update to latest tcnative release by @normanmaurer in #16936
• Move test to shared testsuite by @normanmaurer in #16928
• [Refactor] Useful helper method getOrDefault & cleaner abstraction by @sanjomo in #16927
• Make permessage-deflate server window size and memLevel configurable by @fru1tworld in #16809
• Return early in DnsQueryContext.writeQuery when the query ID space is exhausted by @HwangRock in #16950
• Fix HTTP 2 PUSH_PROMISE stream association validation by @skyguard1 in #16952
• Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by @daguimu in #16951
• Http3FrameCodec handle fragmented payloads when skipping unknown frames by @skyguard1 in #16960
• Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by @hyperxpro in #16932
• Strictly validate MQTT UTF-8 Encoded String by @skyguard1 in #16939
• Stop DateFormatter trailing token from running past the parse end by @daguimu in #16958
• IpFilter: Deprecate constructor which use accept by default by @normanmaurer in #16961
• Add RFC 10008 QUERY Method support by @desiderantes in #16966
• Correctly release and fail queued traffic-shaping writes on close by @skyguard1 in #16959
• Reject control characters at the boundary of the HTTP version token by @HwangRock in #16971
• FlowControlHandler: respect auto-read when toggled while dequeueing by @schiemon in #16949
• Fix leak in ReferenceCountedOpenSslEngine.addCredential by @jmcrawford45 in #16979
• IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout by @husseinvr97 in #16982
• Fix typo in AbstractSniHandler Javadoc by @coderbruis in #16988
• Fix client/server inconsistency in SslCredential support matrix by @jmcrawford45 in #16990
• Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by @gavinbunney in #16947
• Use Ticker in Http2MaxRstFrameListener for testability by @skyguard1 in #16993
• Reset UTF-8 decode state on CR in StompSubframeDecoder by @vasiliy-mikhailov in #16991
• FastLz: Guard decompression against truncated input by @yawkat in #17000
• Reject non-token characters in HTTP/2 header names by @daguimu in #16762
• Auto-port 4.2: Fix SelfSignCertificate initialization in tests by @netty-project-bot in #17029
• Enable extension of Http3ClientConnectionHandler to support higher-level protocols such as WebTransport. by @sanjomo in #17027
• Implement Adaptive Cumulator by @shivaspeaks in #16731
• Allow WebSocket extension negotiation to be disabled per response by @mkurz in #17030
• Support QPACK sensitivity detector for Never Indexed header fields by @skyguard1 in #17026
• Fix maxAllocation for brotli-encoded content in HttpContentDecompressor by @skyguard1 in #17037
• Pin github actions to reduce risk by @normanmaurer in #17043
• Update lz4-java to 1.11.1 by @yawkat in #17061
• Merge branches from forks by @chrisvest in #17063

New Contributors

• @HwangRock made their first contribution in #16950
• @desiderantes made their first contribution in #16966
• @husseinvr97 made their first contribution in #16982
• @gavinbunney made their first contribution in #16947
• @vasiliy-mikhailov made their first contribution in #16991
• @shivaspeaks made their first contribution in #16731

Full Changelog: netty-4.2.15.Final...netty-4.2.16.Final

Security fixes

• CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
• CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
• CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.
• CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
• CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
• CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).
• CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
• CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).
• CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
• CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
• CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).
• CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.
• CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).
• CVE-2026-47244: denial of service in io.netty:netty-codec-http2.
• CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).
• CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

• Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in #16836
• HTTP/2: Parse request-target path like Vert.x by @yawkat in #16810
• Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in #16853
• FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in #16837
• Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in #16844
• Fix revapi warnings by @chrisvest in #16885
• Fix SCTP and Redis tests by @chrisvest in #16893
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in #16850
• Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in #16890

New Contributors

• @schiemon made their first contribution in #16837
• @fedinskiy made their first contribution in #16844

Full Changelog: netty-4.2.14.Final...netty-4.2.15.Final

Security fixes

• CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
• CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
• CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
• CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
• CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
• CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
• CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
• CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).
• CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.
• CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).
• CVE-2026-47244: denial of service in io.netty:netty-codec-http2.
• CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

• Auto-port 4.1: MQTT: Allow MQTT 5 CONNECT with password only by @netty-project-bot in #16834
• ChannelInitializer: correct misleading comment on exceptionCaught route by @daguimu in #16847
• HTTP/2: Parse request-target path like Vert.x (4.1 backport) by @yawkat in #16856
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted by @normanmaurer in #16861
• IpSubnetFilter: Correctly handle ipv6 by @normanmaurer in #16860
• Configurable bound on RedisArrayAggregator by @normanmaurer in #16858
• Redis: Limit decoded length by @normanmaurer in #16859
• DNS: Ensure query id is not predictible by @normanmaurer in #16870
• Wrapping plain trust manager silently disables hostname verification by @normanmaurer in #16868
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @daguimu in #16852
• Fix revapi warnings (#16885) by @chrisvest in #16892
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory by @normanmaurer in #16866
• SSL: Use sane defaults as limits for the client hello length and timeout by @normanmaurer in #16871
• DNS: Only cache CNAME if part of the queried domain by @normanmaurer in #16873
• HTTP/2: Enforce max concurrent streams for misbehaving clients by @normanmaurer in #16876
• Dns: Insufficient Bailiwick Validation for NS Records by @normanmaurer in #16877
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases by @normanmaurer in #16880
• Pass maxAllocation to Brotli and Zstd decoders (#16844) by @chrisvest in #16886
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory by @normanmaurer in #16883
• Auto-port 4.1: Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @netty-project-bot in #16894
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs by @normanmaurer in #16881
• Epoll / Kqueue: Correctly handle receive of FD by @normanmaurer in #16872
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments by @normanmaurer in #16875
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator by @normanmaurer in #16878
• Redis: Limit the maximum number of nested arrays by @normanmaurer in #16882

Full Changelog: netty-4.1.134.Final...netty-4.1.135.Final

What's Changed

• HTTP: Fix revapi failure introduced by 84530fa by @normanmaurer in #16748
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in #16747
• Marshalling: Explicit document security requirements by @normanmaurer in #16752
• Fix io_uring op completion TRACE logging by @chrisvest in #16755
• Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in #16758
• Avoid re-parsing openssl key material with non-cached provider by @chrisvest in #16759
• Pin HTTP/RTSP version + method normalization to Locale.US by @daguimu in #16765
• Fill MsgHdrMemoryArray#hdrs with null entry on release by @tsegismont in #16764
• Revapi: Use default "oldVersion" by @chrisvest in #16774
• Adaptive: Fix concurrency issue in adaptive allocator by @chrisvest in #16767
• Auto-port 4.2: Make bulk byte moving in ByteBuf faster by @netty-project-bot in #16781
• Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by @daguimu in #16768
• Remove dead native declarations by @pandareen in #16783
• Isolate tests that modify available Security providers by @chrisvest in #16793
• Remove test annotations from a method that isn't a test by @chrisvest in #16792
• Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by @zhangweikop in #16523
• IoUring: extend user data from short to long by @dreamlike-ocean in #16682
• Revert CompositeByteBuf component search fast path by @yawkat in #16811
• HTTP2: Use 100 as default max concurrent streams setting by @normanmaurer in #16804
• Fix ResumptionController wrapping by @chrisvest in #16815
• Resolve all localhost addresses without querying DNS servers by @JulianVennen in #16749
• IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by @normanmaurer in #16803
• Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by @dreamlike-ocean in #16788
• Route synchronous onLookupComplete exceptions via fireExceptionCaught by @kwondh5217 in #16794
• IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by @LuciferYang in #16826
• MQTT: Allow MQTT 5 CONNECT with password only by @shblue21 in #16833
• Fix MQTT decoder size check after variable header replay by @daguimu in #16787

New Contributors

• @pandareen made their first contribution in #16783
• @zhangweikop made their first contribution in #16523
• @JulianVennen made their first contribution in #16749
• @kwondh5217 made their first contribution in #16794
• @shblue21 made their first contribution in #16833

Full Changelog: netty-4.2.13.Final...netty-4.2.14.Final