Skip to content

Upgrade Netty to 4.2.17 - #13030

Open
NianJiuZst wants to merge 1 commit into
grpc:masterfrom
NianJiuZst:codex/netty-4.2.17-cve
Open

Upgrade Netty to 4.2.17#13030
NianJiuZst wants to merge 1 commit into
grpc:masterfrom
NianJiuZst:codex/netty-4.2.17-cve

Conversation

@NianJiuZst

Copy link
Copy Markdown
Contributor

Summary

  • upgrade Netty dependencies from 4.2.16.Final to 4.2.17.Final in the Gradle and Bazel declarations
  • document the Netty version used by the 1.85 development line
  • retain netty-tcnative 2.0.81.Final, which is the version used by Netty 4.2.17

Netty 4.2.17 is the first 4.2 release patched for CVE-2026-75596.

Testing

  • ./gradlew :grpc-netty:assemble :grpc-netty:checkstyleMain :grpc-netty:checkstyleTest :grpc-netty:animalsnifferMain :grpc-netty-shaded:assemble -PskipCodegen=true -PskipAndroid=true
  • ./gradlew :grpc-netty:build :grpc-netty-shaded:build -PskipCodegen=true -PskipAndroid=true: 647 Netty tests completed; 2 timed out and 79 were skipped. The same two NettyServerTest timeouts, multiPortConnections and connectionSettingsPropagated, reproduce on an unmodified worktree at upstream/master fc4314419dca8dab8383f8687c9be4982dae9054.

Fixes #13027

Update the Gradle and Bazel dependency declarations to the first Netty 4.2 release patched for CVE-2026-75596. Keep netty-tcnative at the 2.0.81 version used by Netty 4.2.17.

Fixes grpc#13027
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

netty-shaded:1.84.0 is flagged with CVE-2026-75596

1 participant