You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@qpid.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/08 23:10:53 UTC

[PR] Bump io.netty:netty-transport-native-epoll from 4.2.12.Final to 4.2.15.Final [qpid-protonj2]

dependabot[bot] opened a new pull request, #19:
URL: https://github.com/apache/qpid-protonj2/pull/19

   Bumps [io.netty:netty-transport-native-epoll](https://github.com/netty/netty) from 4.2.12.Final to 4.2.15.Final.
   <details>
   <summary>Release notes</summary>
   <p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-transport-native-epoll's releases</a>.</em></p>
   <blockquote>
   <h2>netty-4.2.15.Final</h2>
   <h2>Security fixes</h2>
   <ul>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j">CVE-2026-48059</a>: memory exhaustion in <code>io.netty:netty-codec-haproxy</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85">CVE-2026-47691</a>: DNS cache poisoning in <code>io.netty:netty-resolver-dns</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm">CVE-2026-50560</a>: DDoS in <code>io.netty:netty-codec-http2</code>.</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7">CVE-2026-50011</a>: memory exhaustion in <code>io.netty:netty-codec-redis</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2">CVE-2026-44250</a>: memory exhaustion in <code>io.netty:netty-codec-redis</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3">CVE-2026-44890</a>: memory exhaustion in <code>io.netty:netty-codec-redis</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-cq4q-cv5g-r8q5">CVE-2026-50009</a>: information disclosure and denial of service in <code>io.netty:netty-codec-classes-quic</code>.</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86">CVE-2026-44249</a>: IPv6 subnet filter bypass in <code>io.netty:netty-handler</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c">CVE-2026-50020</a>: request smuggling in <code>io.netty:netty-codec-http</code>.</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c2rx-5r8w-8xr2">CVE-2026-44892</a>: memory exhaustion in <code>io.netty:netty-codec-http3</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv">CVE-2026-44893</a>: memory leak in <code>io.netty:netty-codec-haproxy</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-cmm3-54f8-px4j">CVE-2026-44894</a>: traffic amplification in <code>io.netty:netty-codec-classes-quic</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9">CVE-2026-50010</a>: TLS hostname verification accidentally disabled in <code>io.netty:netty-handler</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78">CVE-2026-45673</a>: DNS cache poisoning in <code>io.netty:netty-resolver-dns</code>.</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh">CVE-2026-45416</a>: excessive memory usage from SNIHandler in <code>io.netty:netty-handler</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9">CVE-2026-45536</a>: file descriptor leak in <code>io.netty:netty-transport-native-epoll</code> and <code>io.netty:netty-transport-native-kqueue</code>.</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc">CVE-2026-45674</a>: DNS cache poisoning in <code>io.netty:netty-resolver-dns</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch">CVE-2026-46340</a>: memory exhaustion in <code>io.netty:netty-transport-sctp</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q">CVE-2026-47244</a>: denial of service in <code>io.netty:netty-codec-http2</code>.</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm">CVE-2026-48006</a>: memory exhaustion in <code>io.netty:netty-codec-redis</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6">CVE-2026-48748</a>: memory exhaustion in <code>io.netty:netty-codec-http3</code> (high).</li>
   <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j">CVE-2026-48043</a>: memory exhaustion in <code>io.netty:netty-codec-http2</code>.</li>
   </ul>
   <h2>What's Changed</h2>
   <ul>
   <li>Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by <a href="https://github.com/dreamlike-ocean"><code>@dreamlike-ocean</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16836">netty/netty#16836</a></li>
   <li>HTTP/2: Parse request-target path like Vert.x by <a href="https://github.com/yawkat"><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16810">netty/netty#16810</a></li>
   <li>Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by <a href="https://github.com/netty-project-bot"><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16853">netty/netty#16853</a></li>
   <li>FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (<a href="https://redirect.github.com/netty/netty/issues/15053">#15053</a>) by <a href="https://github.com/schiemon"><code>@schiemon</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16837">netty/netty#16837</a></li>
   <li>Pass maxAllocation to Brotli and Zstd decoders by <a href="https://github.com/fedinskiy"><code>@fedinskiy</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16844">netty/netty#16844</a></li>
   <li>Fix revapi warnings by <a href="https://github.com/chrisvest"><code>@chrisvest</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16885">netty/netty#16885</a></li>
   <li>Fix SCTP and Redis tests by <a href="https://github.com/chrisvest"><code>@chrisvest</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16893">netty/netty#16893</a></li>
   <li>Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by <a href="https://github.com/skyguard1"><code>@skyguard1</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16850">netty/netty#16850</a></li>
   <li>Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by <a href="https://github.com/netty-project-bot"><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16890">netty/netty#16890</a></li>
   </ul>
   <h2>New Contributors</h2>
   <ul>
   <li><a href="https://github.com/schiemon"><code>@schiemon</code></a> made their first contribution in <a href="https://redirect.github.com/netty/netty/pull/16837">netty/netty#16837</a></li>
   <li><a href="https://github.com/fedinskiy"><code>@fedinskiy</code></a> made their first contribution in <a href="https://redirect.github.com/netty/netty/pull/16844">netty/netty#16844</a></li>
   </ul>
   <p><strong>Full Changelog</strong>: <a href="https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final">https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final</a></p>
   <h2>netty-4.2.14.Final</h2>
   <h2>What's Changed</h2>
   <ul>
   <li>HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16748">netty/netty#16748</a></li>
   <li>HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16747">netty/netty#16747</a></li>
   <li>Marshalling: Explicit document security requirements by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16752">netty/netty#16752</a></li>
   <li>Fix io_uring op completion TRACE logging by <a href="https://github.com/chrisvest"><code>@chrisvest</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16755">netty/netty#16755</a></li>
   <li>Quic: Ensure writes are done before notify close promise of QuicheQui… by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16758">netty/netty#16758</a></li>
   <li>Avoid re-parsing openssl key material with non-cached provider by <a href="https://github.com/chrisvest"><code>@chrisvest</code></a> in <a href="https://redirect.github.com/netty/netty/pull/16759">netty/netty#16759</a></li>
   </ul>
   <!-- raw HTML omitted -->
   </blockquote>
   <p>... (truncated)</p>
   </details>
   <details>
   <summary>Commits</summary>
   <ul>
   <li><a href="https://github.com/netty/netty/commit/a41f7b289ce1d697c50846f3ade3983e22b2ed40"><code>a41f7b2</code></a> [maven-release-plugin] prepare release netty-4.2.15.Final</li>
   <li><a href="https://github.com/netty/netty/commit/2394530bdb6837d928c2ec0b4d8f598487059ef9"><code>2394530</code></a> Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...</li>
   <li><a href="https://github.com/netty/netty/commit/0bd1657a601da85c324d28562dc7d1ae220ad3a7"><code>0bd1657</code></a> Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (<a href="https://redirect.github.com/netty/netty/issues/16850">#16850</a>)</li>
   <li><a href="https://github.com/netty/netty/commit/76291f58a901e021289e5c30618b6e136d605163"><code>76291f5</code></a> Fix SCTP and Redis tests (<a href="https://redirect.github.com/netty/netty/issues/16893">#16893</a>)</li>
   <li><a href="https://github.com/netty/netty/commit/e067b6e3376afee7629481d46333c3acf7f95943"><code>e067b6e</code></a> Fix revapi warnings (<a href="https://redirect.github.com/netty/netty/issues/16885">#16885</a>)</li>
   <li><a href="https://github.com/netty/netty/commit/5a52600d96cc6f4d38098e0645be53ecbfc8a811"><code>5a52600</code></a> Pass maxAllocation to Brotli and Zstd decoders (<a href="https://redirect.github.com/netty/netty/issues/16844">#16844</a>)</li>
   <li><a href="https://github.com/netty/netty/commit/541add0f7f5486ef15834da51d8dd983ec12e2b3"><code>541add0</code></a> Merge commit from fork</li>
   <li><a href="https://github.com/netty/netty/commit/270800e5d336913606493a562c8200ecf321a0c1"><code>270800e</code></a> Merge commit from fork</li>
   <li><a href="https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"><code>3d45a1e</code></a> Merge commit from fork</li>
   <li><a href="https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d"><code>75127ca</code></a> Merge commit from fork</li>
   <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.12.Final...netty-4.2.15.Final">compare view</a></li>
   </ul>
   </details>
   <br />
   
   
   [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.netty:netty-transport-native-epoll&package-manager=maven&previous-version=4.2.12.Final&new-version=4.2.15.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
   
   Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
   
   [//]: # (dependabot-automerge-start)
   [//]: # (dependabot-automerge-end)
   
   ---
   
   <details>
   <summary>Dependabot commands and options</summary>
   <br />
   
   You can trigger Dependabot actions by commenting on this PR:
   - `@dependabot rebase` will rebase this PR
   - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
   - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
   - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
   You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/qpid-protonj2/network/alerts).
   
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org

Re: [PR] Bump io.netty:netty-transport-native-epoll from 4.2.12.Final to 4.2.15.Final [qpid-protonj2]

Posted by "tabish121 (via GitHub)" <gi...@apache.org>.

tabish121 commented on PR #19:
URL: https://github.com/apache/qpid-protonj2/pull/19#issuecomment-5136333691

   @dependabot rebase


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org

Re: [PR] Bump io.netty:netty-transport-native-epoll from 4.2.12.Final to 4.2.15.Final [qpid-protonj2]

Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.

dependabot[bot] commented on PR #19:
URL: https://github.com/apache/qpid-protonj2/pull/19#issuecomment-5136340052

   Looks like io.netty:netty-transport-native-epoll is up-to-date now, so this is no longer needed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org

Re: [PR] Bump io.netty:netty-transport-native-epoll from 4.2.12.Final to 4.2.15.Final [qpid-protonj2]

Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.

dependabot[bot] closed pull request #19: Bump io.netty:netty-transport-native-epoll from 4.2.12.Final to 4.2.15.Final
URL: https://github.com/apache/qpid-protonj2/pull/19


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org