[
https://issues.apache.org/jira/browse/SPARK-59889?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anoopam Sharma resolved SPARK-59889.
------------------------------------
Resolution: Fixed
JIRA SPARK-59889 is a duplicate of SPARK-59422
> [BUILD] Upgrade Netty to 4.2.18.Final
> -------------------------------------
>
> Key: SPARK-59889
> URL: https://issues.apache.org/jira/browse/SPARK-59889
> Project: Spark
> Issue Type: Improvement
> Components: Build
> Affects Versions: 5.0.0
> Reporter: Anoopam Sharma
> Priority: Minor
>
> Upgrade Netty from 4.2.17.Final to 4.2.18.Final to fix CVE-2026-100660 and
> CVE-2026-100663.
> CVE-2026-100660 (HIGH 7.5): The HTTP/3 QPACK encoder (netty-codec-http3)
> retains per-stream state indefinitely when remote clients do not
> acknowledge encoded data, with no memory limits enforced. A remote,
> unauthenticated attacker can cause unbounded memory consumption and Denial
> of Service (CWE-770).
> CVE-2026-100663 (HIGH 7.5): Netty's HTTP/3 codec mistranslates HTTP/1
> CONNECT authority-form request-targets when converting to HTTP/3 in
> HttpConversionUtil.toHttp3Headers, allowing an attacker-controlled tunnel
> :authority that can bypass allow-lists, egress policy, or audit
> controls in an HTTP/1-to-HTTP/3 proxy (CWE-20). Affected: 4.2.2.Final
> through 4.2.17.Final.
> Fixed in Netty 4.2.18.Final (released 2026-09-09).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
