Skip to content

Upgrade Netty to 4.2.17 - #13030

Closed
NianJiuZst wants to merge 1 commit into
grpc:masterfrom
NianJiuZst:codex/netty-4.2.17-cve
Closed

NianJiuZst wants to merge 1 commit into
grpc:masterfrom
NianJiuZst:codex/netty-4.2.17-cve

Conversation

@NianJiuZst

Copy link
Copy Markdown
Contributor

Summary

  • upgrade Netty dependencies from 4.2.16.Final to 4.2.17.Final in the Gradle and Bazel declarations
  • document the Netty version used by the 1.85 development line
  • retain netty-tcnative 2.0.81.Final, which is the version used by Netty 4.2.17

Netty 4.2.17 is the first 4.2 release patched for CVE-2026-75596.

Testing

  • ./gradlew :grpc-netty:assemble :grpc-netty:checkstyleMain :grpc-netty:checkstyleTest :grpc-netty:animalsnifferMain :grpc-netty-shaded:assemble -PskipCodegen=true -PskipAndroid=true
  • ./gradlew :grpc-netty:build :grpc-netty-shaded:build -PskipCodegen=true -PskipAndroid=true: 647 Netty tests completed; 2 timed out and 79 were skipped. The same two NettyServerTest timeouts, multiPortConnections and connectionSettingsPropagated, reproduce on an unmodified worktree at upstream/master fc4314419dca8dab8383f8687c9be4982dae9054.

Fixes #13027

Update the Gradle and Bazel dependency declarations to the first Netty 4.2 release patched for CVE-2026-75596. Keep netty-tcnative at the 2.0.81 version used by Netty 4.2.17.

Fixes grpc#13027
@kannanjgithub

Copy link
Copy Markdown
Contributor

The maintainers have done this in #13036 since there are internal to Google tests to be verified.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

netty-shaded:1.84.0 is flagged with CVE-2026-75596

2 participants