#netty — Public Fediverse posts

CVE Alert: CVE-2026-62243 - netty - netty - https://www.redpacketsecurity.com/cve-alert-cve-2026-62243-netty-netty/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-62243 #netty #

Netty: 70 CVEs tracked, 45% unpatched, max CVSS 8.7. 2026 trend +51. Top risk: resource exhaustion (CWE-400). Java networking framework—patch or get DoS'd. #Netty #infosec #cybersecurity

https://www.valtersit.com/vendors/netty/

We’ve released Netty 4.2.17.Final, which fixes bugs and security issues:
https://netty.io/news/2026/08/04/4-2-17-Final.html

4.1.137.Final follows tomorrow or today, depending on your time zone.
#netty #java

Netty: 70 CVEs, max CVSS 8.7, 45% unpatched. No CISA KEV yet, but CVE trend +51 into 2026. Top issue: resource exhaustion (CWE-400). Patch your Java networking now. #Netty #infosec #cybersecurity

https://www.valtersit.com/vendors/netty/

We’ve released Netty 4.2.16.Final, which fixes a number of bugs and security issues: https://netty.io/news/2026/07/06/4-2-16-Final.html
#java #netty

On Monday, July 6, we'll do a #netty release which will fix CVEs. We don't know how many yet.

CVE-2026-50010 - High severity flaw in Netty's X509TrustManager wrapper. SSLEngine discarded in trust checks, potentially enabling MITM attacks. CVSS 7.5. No patch yet. Monitor & mitigate. #CVE #Netty #infosec

https://www.valtersit.com/cve/CVE-2026-50010/

Как я реализовал Connect RPC на Java с помощью AI-агентов

В статье я делюсь практиками работы с Claude Code и Codex, которые помогли мне реализовать сложную техническую задачу в условиях ограниченного времени, бюджета и железа.

https://habr.com/ru/articles/1045542/

#java #netty #connectrpc

We've now also released #Netty 4.1.135.Final, mostly with backported fixes for bugs and security issues:
- https://netty.io/news/2026/06/02/4-1-135-Final.html

We've released Netty 4.2.15.Final, fixing 22 CVEs (http, http2, http3, compression, dns, haproxy, redis) and a number of bugs:
- https://netty.io/news/2026/06/01/4-2-15-Final.html

The contents of the CVE advisories will be published later.

#netty #java

📣 We're planning a #Netty release next Monday, June 1st, which will include 20+ CVE fixes.

We've released #Netty 4.2.14 and 4.1.134, which are bug-fix releases:

https://netty.io/news/2026/05/20/4-2-14-Final.html
https://netty.io/news/2026/05/20/4-1-134-Final.html

They fix an MQTT parsing regression introduced in the previous release, and a recently introduced CompositeByteBuf bug, among a few others.

We've released #Netty 4.2.13.Final and 4.1.133.Final, fixing 13 CVEs (http, http2, http3, compression, dns, mqtt, proxy, redis) and a number of bugs:
* https://netty.io/news/2026/05/04/4-2-13-Final.html
* https://netty.io/news/2026/05/04/4-1-133-Final.html

We will do a #Netty release sometime in a few days, late this week or early next week. It will fix many security issues; more than usual. Be prepared to update.

WebFlux vs Virtual Threads: что происходит при 2000 RPS

Всем привет! Меня зовут Александр, и сегодня я расскажу о результатах перевода учебного проекта со Spring WebFlux и Netty на Spring MVC и Tomcat с виртуальными потоками и проверки обоих вариантов под нагрузкой в 2000rps. В качестве подопытного будет выступать система микросервисов, разработанная в рамках курса CloudJava .

https://habr.com/ru/articles/1024936/

#Java #virtual_threads #webflux #springboot #netty #tomcat

We've released Netty 4.2.12.Final. This fixes a regression introduced in 4.2.11.Final, in the CompositeByteBuf implementation.

Release notes: https://netty.io/news/2026/03/24/4-2-12-Final.html
#netty #java

We're released Netty 4.2.11 and 4.1.132. These contain many bug fixes, and fixes for two CVEs both rated *high*:

- CVE-2026-33871: HTTP/2 CONTINUATION frame flood Denial of Service.
- CVE-2026-33870: HTTP/1.1 Request Smuggling vulnerability in chunked encoding parsing.

Release notes for 4.2.11: https://netty.io/news/2026/03/24/4-2-11-Final.html
Release notes for 4.1.132: https://netty.io/news/2026/03/24/4-1-132-Final.html

Also of note: We had 17 people contribute to Netty 4.2.11, of which 5 are new first time contributors 😲

#netty #java

Бойтесь буквы «M». Самый странный баг в моей жизни

Вечером в пятницу коллега, назовем его Мститель, спросил, не сталкивался ли я с проблемой, что route возвращает 400... но «если сменить название на сильно другое», то всё ок. Я сперва не обратил внимание на слово «сильно». Может быть, где-то дублируется регистрация этого рута? Или мститель перепутал GET и POST. Или какой-то баг в общем на создание хэндлеров? Милости просим

https://habr.com/ru/articles/1006164/

#java #netty #bug #биты #long #побитовые_операторы #сдвиг #backend #verification #баги

#Netty joined the GitHub Secure OSS Fund.
Most immediate impact for us is that we reviewed our project security settings, e.g. we now enforce that all maintainers have 2FA.
We also formalized our incident response plan and threat model.
There's still more we want to do in this area, but the missing pieces are clearer and more concrete.

https://github.blog/open-source/maintainers/securing-the-ai-software-supply-chain-security-results-across-67-open-source-projects/

We've also released #Netty 4.1.131 with bug fixes: https://netty.io/news/2026/02/06/4-1-131-Final.html

We've released #Netty 4.2.10 with many bug fixes and improvements: https://netty.io/news/2026/02/05/4-2-10.html #java

RE: https://mastodon.social/@openjdk/115883872388466410

If you use recent #Netty with BoringSSL, you already have this feature: having X25519MLKEM768 enabled by default for TLSv1.3.

If you didn't know, #Netty 4.2.8 and newer enable the X25519MLKEM768 post-quantum key agreement protocol by default when using BoringSSL or AWS-LC. This prevents harvest-now-decrypt-later attacks, for TLS connections where the peer also supports this protocol. Thanks to protocol negotiation in TLS, this enablement is portable and backwards compatible.
Reference: https://github.com/netty/netty/pull/15830

We've released Netty 4.2.9 and 4.1.130.

They fix CVE-2025-67735 (https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4), which is a line break injection vulnerability when encoding HTTP request objects.

The fix introduced a regression we had to fix as well, so versions 4.2.8 and 4.1.129 are skipped.

https://netty.io/news/2025/12/15/4-2-9.html
https://netty.io/news/2025/12/15/4-2-8.html
https://netty.io/news/2025/12/15/4-1-130-Final.html
https://netty.io/news/2025/12/15/4-1-129-Final.html

#netty #java

We've released Netty 4.2.7 and 4.1.128:
- https://netty.io/news/2025/10/15/4-2-7.html
- https://netty.io/news/2025/10/14/4-1-128-Final.html

They fix numerous bugs, including CVE-2025-59419 https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
#netty #java

The @linuxfoundation has added #Netty to LFX Insights, their index of "the world's most critical open source projects"
https://insights.linuxfoundation.org/project/netty

We've released Netty 4.2.6 and 4.1.127, which fixes a regression introduced in the previous version.
https://netty.io/news/2025/09/08/4-2-6.html
https://netty.io/news/2025/09/08/4-1-127-Final.html
#netty #java

We've released Netty 4.2.5 and 4.1.126:
- https://netty.io/news/2025/09/03/4-2-5.html
- https://netty.io/news/2025/09/03/4-1-126-Final.html

They fix two security issues:
- a zip-bomb attack, CVE-2025-58057: https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj
- an HTTP request smuggling attack, CVE-2025-58056: https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49

#netty #java

In the past week we've done a handful of Netty releases:
- Netty 4.1.124.Final (https://netty.io/news/2025/08/13/4-1-124-Final.html) and 4.2.4.Final (https://netty.io/news/2025/08/13/4-2-4.html) were released, fixing the MadeYouReset HTTP/2 DDoS vulnerability CVE-2025-55163
- Netty 4.2.4 also includes a slew of other bug fixes and enhancements
- Netty/Incubator/Codec/OHTTP 0.0.19.Final fixes a couple of bugs: https://netty.io/news/2025/08/15/ohttp-0-0-19-Final.html
- Netty/Incubator/Codec/Quic 0.0.74.Final fixes CVE-2025-7054: https://netty.io/news/2025/08/18/quic-0-0-74-Final.html
#netty #java