[
https://issues.apache.org/jira/browse/KNOX-3427?focusedWorklogId=1038804&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1038804
]
ASF GitHub Bot logged work on KNOX-3427:
----------------------------------------
Author: ASF GitHub Bot
Created on: 31/Aug/26 12:50
Start Date: 31/Aug/26 12:50
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1366:
URL: https://github.com/apache/knox/pull/1366
[KNOX-3427](https://issues.apache.org/jira/browse/KNOX-3427) - Bump Netty to
1.137.Final
## What changes were proposed in this pull request?
Bumped Netty version to 1.137.Final
## How was this patch tested?
Built and deployed locally.
Relying on unit tests and Docker-based integration tests.
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1038804)
Remaining Estimate: 0h
Time Spent: 10m
> Upgrade Netty to 4.1.137.Final due to CVEs
> ------------------------------------------
>
> Key: KNOX-3427
> URL: https://issues.apache.org/jira/browse/KNOX-3427
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Netty is a network application framework for development of protocol servers
> and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS
> decoder accepts a peer-declared SETTINGS entry count up to the 24-bit
> frame-length limit and materializes every unique setting ID in
> {{{}DefaultSpdySettingsFrame{}}}, allowing a remote SPDY/3.1 peer to send a
> syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map
> entries and amplifies network input into heap growth and ordered-map
> insertion work. This issue is fixed in versions 4.1.136.Final and
> 4.2.16.Final.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
