Fix netty CVE-2026-44249 via AWS SDK bump and azure-core-http-netty pin#7223
Merged
Conversation
…tp-netty Address GHSA-3qp7-7mw8-wx86 / CVE-2026-44249 (IPv6 subnet filter bypass in io.netty:netty-handler, fixed in 4.1.135.Final). Rather than pinning individual netty modules directly, fix the vulnerability at the source of the transitive dependency: - nf-amazon, nf-codecommit: bump AWS SDK 2.44.3 -> 2.46.8, which brings netty 4.1.135.Final transitively (these plugins relied entirely on the AWS SDK transitive netty, so the direct netty-handler pin in PR #7209 does not cover them). - nf-azure: replace the six direct io.netty:* pins with a single pin on com.azure:azure-core-http-netty:1.16.5, which aligns all netty modules to 4.1.135.Final. This avoids the version skew left by bumping only netty-handler while the remaining netty modules stay at 4.1.133.Final, and lets each SDK manage its own internally-consistent, vendor-tested netty set. Signed-off-by: jorgee <[email protected]>
1 task
✅ Deploy Preview for nextflow-docs-staging canceled.
|
1 similar comment
✅ Deploy Preview for nextflow-docs-staging canceled.
|
bentsherman
approved these changes
Jun 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the high-severity netty vulnerability GHSA-3qp7-7mw8-wx86 / CVE-2026-44249 (IPv6 subnet filter bypass in
io.netty:netty-handler, CVSS 8.1, patched in4.1.135.Final) — see dependabot alert #190.This is an alternative to #7209, which only bumps the direct
io.netty:netty-handlerpin innf-azureto4.1.135.Final. That approach is incomplete:nf-azure(netty-common,netty-handler-proxy,netty-codec-http,netty-codec-http2,netty-codec-dns) pinned at4.1.133.Final, causing netty version skew.nf-amazonandnf-codecommit, which carry no direct netty pins and instead inherit vulnerable netty4.1.133.Finaltransitively from the AWS SDK2.44.3(netty-nio-client). Those plugins remain vulnerable after chore: update dependency io.netty:netty-handler to v4.1.135.final [security] #7209.Changes
Fix the vulnerability at the source of the transitive dependency rather than pinning individual netty modules:
2.44.3→2.46.8. The 2.46.8 SDK declaresnetty.version = 4.1.135.Final, so patched netty is pulled in transitively.io.netty:*:4.1.133.Finalpins with a single pin oncom.azure:azure-core-http-netty:1.16.5, whose POM aligns every netty module to4.1.135.Final.Verification
Resolved
runtimeClasspathfor all subprojects audited. After the change, every netty module innf-amazon,nf-azure, andnf-codecommitresolves to4.1.135.Finalwith no version skew.nf-googleusesgrpc-netty-shaded(relocated, not the affected coordinate) andnf-toweronly importsnetty-bom(no netty artifact on the classpath) — neither is affected.Unit tests pass for all three modified plugins (
:plugins:nf-amazon:test,:plugins:nf-azure:test,:plugins:nf-codecommit:test).