You are viewing a plain text version of this content. The canonical link for it is here.

Posted to oak-issues@jackrabbit.apache.org by "Simone Maver (Jira)" <ji...@apache.org> on 2026/09/23 07:36:00 UTC

[jira] [Created] (OAK-12409) Bump netty versions to 4.1.138.Final

Simone Maver created OAK-12409:
----------------------------------

             Summary: Bump netty versions to 4.1.138.Final
                 Key: OAK-12409
                 URL: https://issues.apache.org/jira/browse/OAK-12409
             Project: Jackrabbit Oak
          Issue Type: Task
            Reporter: Simone Maver


Oak 2.6.0 declares netty 4.1.136.Final, which oak-segment-tar and oak-blob-cloud-azure also embed on their Embed-Dependency bundle class path.

Two publicly disclosed issues are fixed above that version:

- CVE-2026-75595 (GHSA-c4c3-7fpv-j4q5, published 2026-09-08), fixed in 4.1.137.Final
- CVE-2026-89044, affecting 4.1.133.Final through 4.1.137.Final, fixed in 4.1.138.Final

4.1.138.Final also carries several further security fixes in netty-codec-http and
netty-codec-http2, so it is the first 4.1.x release that clears all of the above.

References:
https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5
https://nvd.nist.gov/vuln/detail/CVE-2026-75595
https://github.com/netty/netty/releases/tag/netty-4.1.138.Final



--
This message was sent by Atlassian Jira
(v8.20.10#820010)