Skip to content

UID2-6837: Upgrade Netty to 4.1.132.Final (CVE-2026-33870, CVE-2026-33871)#612

Merged
BehnamMozafari merged 1 commit intomainfrom
bmz-UID2-6837-upgrade-netty
Mar 31, 2026
Merged

UID2-6837: Upgrade Netty to 4.1.132.Final (CVE-2026-33870, CVE-2026-33871)#612
BehnamMozafari merged 1 commit intomainfrom
bmz-UID2-6837-upgrade-netty

Conversation

@BehnamMozafari
Copy link
Copy Markdown
Contributor

Summary

  • Add Netty BOM 4.1.132.Final to fix CVE-2026-33870 (HTTP request smuggling, CVSS 7.5) and CVE-2026-33871 (HTTP/2 CONTINUATION flood DoS, CVSS 8.7)
  • Update uid2-shared to 11.4.16 (which also includes the Netty fix)

Test plan

  • CI passes
  • Verify Netty version resolves to 4.1.132.Final via mvn dependency:tree
  • Healthcheck returns 200 in test/integ

🤖 Generated with Claude Code

@BehnamMozafari BehnamMozafari merged commit d2dcdc3 into main Mar 31, 2026
4 of 5 checks passed
@BehnamMozafari BehnamMozafari deleted the bmz-UID2-6837-upgrade-netty branch March 31, 2026 05:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants