[jira] [Resolved] (OAK-12409) Bump netty versions to 4.1.139.Final

["Rishabh Daim (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OAK-12409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rishabh Daim resolved OAK-12409.
--------------------------------
    Resolution: Fixed

> Bump netty versions to 4.1.139.Final
> ------------------------------------
>
>                 Key: OAK-12409
>                 URL: https://issues.apache.org/jira/browse/OAK-12409
>             Project: Jackrabbit Oak
>          Issue Type: Task
>            Reporter: Simone Maver
>            Assignee: Rishabh Daim
>            Priority: Major
>              Labels: candidate_oak_1_22, security-issue
>             Fix For: 1.22.25, 2.8.0
>
>
> Oak 2.6.0 declares netty 4.1.136.Final, which `oak-segment-tar` and `oak-blob-cloud-azure` also embed on their Embed-Dependency bundle class path.
> Two publicly disclosed issues are fixed above that version:
>  - CVE-2026-75595 (GHSA-c4c3-7fpv-j4q5, published 2026-09-08), fixed in 4.1.137.Final
>  - CVE-2026-89044, affecting 4.1.133.Final through 4.1.137.Final, fixed in 4.1.138.Final
> 4.1.138.Final also carries several further security fixes in `netty-codec-http` and
> `netty-codec-http2`, so it is the first 4.1.x release that clears all of the above.
> References:
> [https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5]
> [https://nvd.nist.gov/vuln/detail/CVE-2026-75595]
> [https://github.com/netty/netty/releases/tag/netty-4.1.138.Final]



--
This message was sent by Atlassian Jira
(v8.20.10#820010)