Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-4489


Security update for netty


Type: security
Severity: moderate
Issued: 2025-12-19
Description:
This update for netty fixes the following issues:

Update to upstream version 4.1.130.

Security issues fixed:

- CVE-2025-67735: lack of URI sanitization in `HttpRequestEncoder` allows for CRLF injection through a request URI and
  can lead to request smuggling (bsc#1255048).

Other updates and bugfixes:

- Version 4.1.130:
  * Update `lz4-java` version to 1.10.1
  * Close `Channel` and fail bootstrap when setting a `ChannelOption` causes an error
  * Discard the following `HttpContent` for preflight request
  * Fix race condition in `NonStickyEventExecutorGroup` causing incorrect `inEventLoop()` results
  * Fix Zstd compression for large data
  * Fix `ZstdEncoder` not producing data when source is smaller than block
  * Make big endian ASCII hashcode consistent with little endian
  * Fix reentrancy bug in `ByteToMessageDecoder`
  * Add 32k and 64k size classes to adaptive allocator
  * Re-enable reflective field accesses in native images
  * Correct HTTP/2 padding length check
  * Fix HTTP startline validation
  * Fix `MpscIntQueue` bug

- Build against the `org.jboss:jdk-misc` artifact that is implementing the `sun.misc` classes removed in Java 25


              

Packages


  • netty-4.1.130-150200.4.40.1