Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/24434 )
Change subject: Bump netty to 4.1.133.Final ...................................................................... Patch Set 1: (1 comment) http://gerrit.cloudera.org:8080/#/c/24434/1//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/24434/1//COMMIT_MSG@7 PS1, Line 7: Bump netty to 4.1.133.Final : : This is for fixing multiple CVEs Thank you for the patch. I don't think any of the CVEs addressed in Netty 4.1.133.Final are relevant since Kudu doesn't use that functionality, IIUC. However, if bumping Netty version to please security scanners and reduce CVE count, why not to update up to 4.1.135.Final release? There are many more CVEs fixed in Netty 4.1.135.Final: https://github.com/netty/netty/releases/tag/netty-4.1.135.Final As far as I can see, Netty 4.1.135.Final addresses at least CVE-2026-47691 (DNS cache poisoning) which is relevant to the functionality that Kudu Java client relies upon. What do you think of updating rather up to Netty 4.1.135.Final? -- To view, visit http://gerrit.cloudera.org:8080/24434 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I42ebbcdb1d91d6d69fa44b416c94fcf16b4d2e27 Gerrit-Change-Number: 24434 Gerrit-PatchSet: 1 Gerrit-Owner: Anonymous Coward <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Comment-Date: Wed, 10 Jun 2026 19:04:34 +0000 Gerrit-HasComments: Yes
