Skip to content

Pin HTTP/RTSP version + method normalization to Locale.US#16765

Merged
chrisvest merged 1 commit into
netty:4.2from
daguimu:fix/http-rtsp-version-method-locale-us
May 8, 2026
Merged

Pin HTTP/RTSP version + method normalization to Locale.US#16765
chrisvest merged 1 commit into
netty:4.2from
daguimu:fix/http-rtsp-version-method-locale-us

Conversation

@daguimu
Copy link
Copy Markdown
Contributor

@daguimu daguimu commented May 7, 2026

Problem

HttpVersion, RtspVersions and RtspMethods all uppercase their input via String.toUpperCase() without an explicit Locale. The JVM default locale governs that call, and in Turkish (tr_TR) the ASCII letter 'i' uppercases to 'İ' (U+0130), not 'I'.

Concretely, on a Turkish-locale JVM:

  • RtspMethods.valueOf("describe") produces "DESCRİBE" after the uppercase, fails the cache lookup, falls through to HttpMethod.valueOf(...), and throws IllegalArgumentException: Illegal character in HTTP Method: 0x130 for what is otherwise a perfectly valid RTSP method. Same for "redirect" (REDİRECT).
  • HttpVersion.valueOf("icap/1.0") and the (protocolName, major, minor, ...) constructor with "icap" end up with protocolName() containing U+0130 instead of plain ASCII 'I'. The version no longer matches its own canonical form.

The protocol grammars are ASCII-only (RFC 7230 §2.6 / RFC 2326 §1.4), so the uppercase has no business consulting the JVM locale.

Fix

Pin every String.toUpperCase() in these three classes to Locale.US:

  • codec-http/src/main/java/io/netty/handler/codec/http/HttpVersion.java
    • (text, strict, keepAliveDefault) constructor — line that normalizes the supplied protocol string.
    • (protocolName, major, minor, keepAliveDefault, bytes) constructor — line that normalizes the supplied protocol name.
  • codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspMethods.java
    • valueOf(String name) — line that normalizes the supplied RTSP method name before the cache lookup.
  • codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspVersions.java
    • valueOf(String text) — line that normalizes the supplied version string before comparing to the cached RTSP/1.0.

AsciiString.toUpperCase() / AsciiString.toLowerCase() paths in the same module are already ASCII-byte-level and not affected by this issue, so they are left alone.

Tests

codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java:

Change Point Test
HttpVersion.valueOf(text) under Turkish locale testLowercaseIotaProtocolNameUnderTurkishLocale — installs Locale.setDefault(new Locale("tr","TR")) (restored in finally) and asserts valueOf("icap/1.0") returns a version whose protocolName() is the ASCII "ICAP" and whose text() is "ICAP/1.0".
HttpVersion(protocolName, major, minor, ...) under Turkish locale testProtocolNameConstructorUnderTurkishLocale — same locale setup, asserts new HttpVersion("icap", 1, 0, true) ends up with protocolName() = "ICAP" and text() = "ICAP/1.0".

New codec-http/src/test/java/io/netty/handler/codec/rtsp/RtspMethodsTest.java:

Change Point Test
Cached uppercase lookup still works valueOfReturnsCachedInstanceForUppercaseName
Lowercase normalization under default locale valueOfNormalizesLowercaseInputUnderUsLocale
Lowercase normalization under Turkish locale valueOfNormalizesLowercaseInputUnderTurkishLocale — installs tr_TR, calls valueOf("describe") and valueOf("redirect"), asserts both resolve to the cached DESCRIBE / REDIRECT instances.

All three Turkish-locale tests fail deterministically against the unfixed code (one with a clean assertion failure, the RtspMethods one with IllegalArgumentException: Illegal character in HTTP Method: 0x130) and pass after the Locale.US change.

Verification:

mvn -pl codec-http -am test -Dtest='HttpVersionParsingTest,RtspMethodsTest' -Dsurefire.failIfNoSpecifiedTests=false
# Tests run: 52, Failures: 0, Errors: 0, Skipped: 0

Impact

  • Behavior on en/CJK/most locales: unchanged (the previous default-locale uppercase already produced ASCII).
  • Behavior on Turkish (and other locales with non-ASCII case mappings, e.g. Azerbaijani): RTSP method parsing and HTTP-derived version parsing of lowercase or mixed-case inputs now succeed instead of throwing or returning a U+0130-tainted result.
  • API: no signature change. All callers continue to use valueOf(String) / the existing constructors.
  • Risk: bounded — Locale.US is the standard Netty pattern for protocol-string normalization (see e.g. WebSocketClientHandshaker.java:761).

@normanmaurer normanmaurer requested a review from chrisvest May 7, 2026 17:46
@normanmaurer normanmaurer added this to the 4.2.14.Final milestone May 7, 2026
@normanmaurer normanmaurer added needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. labels May 7, 2026
Copy link
Copy Markdown
Member

@chrisvest chrisvest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please address my comments, then it looks good.

Comment thread codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java Outdated
`HttpVersion`, `RtspVersions` and `RtspMethods` all uppercase their
input via `String.toUpperCase()` without an explicit Locale. The JVM
default Locale governs that call, and in Turkish (`tr_TR`) the
ASCII letter `'i'` uppercases to `'İ'` (U+0130), not `'I'`.

Concretely, on a Turkish-locale JVM:

- `RtspMethods.valueOf("describe")` produces `"DESCRİBE"` after the
  uppercase, fails the cache lookup, falls through to
  `HttpMethod.valueOf(...)` and throws
  `IllegalArgumentException: Illegal character in HTTP Method: 0x130`
  for what is otherwise a perfectly valid RTSP method.
- `HttpVersion.valueOf("icap/1.0")` (and the
  `(protocolName, major, minor, ...)` constructor with `"icap"`) end
  up with a protocolName containing U+0130 instead of ASCII `'I'`.

The protocol grammars are ASCII-only (RFC 7230 / 2326), so the
uppercase has no business consulting the JVM locale. Pin every
`toUpperCase()` in these three classes to `Locale.US`.

Tests:

- `HttpVersionParsingTest.testLowercaseIotaProtocolNameUnderTurkishLocale`
  and `.testProtocolNameConstructorUnderTurkishLocale` install the
  Turkish locale via `Locale.setDefault(...)` (restored in `finally`)
  and assert the protocolName / text round-trip back to ASCII.
- New `RtspMethodsTest` covers cached-uppercase resolution, the
  ordinary lowercase normalization path, and the Turkish-locale
  variant.

All three Turkish-locale tests fail deterministically without the
`Locale.US` change and pass after it.
@daguimu daguimu force-pushed the fix/http-rtsp-version-method-locale-us branch from 7bed8ef to 64c47e0 Compare May 8, 2026 02:25
daguimu added a commit to daguimu/netty that referenced this pull request May 8, 2026
…o Locale.US

Two spots in the multipart codec call `String.toLowerCase()` without an
explicit Locale to normalize a header value before comparing it to
lowercase ASCII constants. The JVM default locale governs that call, and
in Turkish (`tr_TR`) the ASCII letter `'I'` lowercases to `'ı'`
(U+0131) - so a perfectly valid uppercase form misses the comparison.

Concretely on a Turkish-locale JVM:

- `HttpPostMultipartRequestDecoder` decoding a part with
  `Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 says the
  mechanism token is case-insensitive) lowercases it to `"bınary"`,
  fails the equality check against the `binary` / `7bit` / `8bit`
  constants, and throws
  `ErrorDataDecoderException: TransferEncoding Unknown: bınary`.
- `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing
  `Content-Type: MULTIPART/form-data` header (mixed case, allowed by
  the Content-Type ABNF) lowercases it to `"multıpart/..."`, misses
  the prefix check, and the original mixed-case header stays on the
  request alongside the freshly-built multipart Content-Type. The
  request goes out with two `Content-Type` headers.

Pin both `toLowerCase()` calls to `Locale.US`. The values being
compared against are lowercase ASCII tokens and have no business
consulting the JVM locale.

Tests:

- `HttpPostMultiPartRequestDecoderTest
  .testUppercaseBinaryTransferEncodingUnderTurkishLocale` installs the
  Turkish locale via `Locale.setDefault(...)` (restored in `finally`)
  and feeds a multipart body with `Content-Transfer-Encoding: BINARY`.
  Without the fix it throws; after the fix the file part decodes
  successfully.
- `HttpPostRequestEncoderTest
  .testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale`
  pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`
  on the request, runs the encoder under the Turkish locale, and
  asserts only one Content-Type header survives - the encoder's own.
  Without the fix the request ends up with two Content-Type headers.

Both tests fail deterministically on the unfixed code (one as an
assertion, the other as `TransferEncoding Unknown: bınary`).

Sibling fix to netty#16765, which addressed the same locale gotcha in
`HttpVersion`, `RtspMethods`, and `RtspVersions`.
@chrisvest chrisvest merged commit e6d7cf7 into netty:4.2 May 8, 2026
19 checks passed
@netty-project-bot
Copy link
Copy Markdown
Contributor

Could not create auto-port PR.
Got conflicts when cherry-picking onto 4.1.

@netty-project-bot
Copy link
Copy Markdown
Contributor

Auto-port PR for 5.0: #16769

@github-actions github-actions Bot removed the needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. label May 8, 2026
@normanmaurer
Copy link
Copy Markdown
Member

PR for 4.1 #16770

@daguimu daguimu deleted the fix/http-rtsp-version-method-locale-us branch May 8, 2026 07:58
normanmaurer added a commit that referenced this pull request May 8, 2026
…16770)

`HttpVersion`, `RtspVersions` and `RtspMethods` all uppercase their
input via `String.toUpperCase()` without an explicit `Locale`. The JVM
default locale governs that call, and in Turkish (`tr_TR`) the ASCII
letter `'i'` uppercases to `'İ'` (U+0130), not `'I'`.

Concretely, on a Turkish-locale JVM:

- `RtspMethods.valueOf("describe")` produces `"DESCRİBE"` after the
uppercase, fails the cache lookup, falls through to
`HttpMethod.valueOf(...)`, and throws `IllegalArgumentException: Illegal
character in HTTP Method: 0x130` for what is otherwise a perfectly valid
RTSP method. Same for `"redirect"` (`REDİRECT`).
- `HttpVersion.valueOf("icap/1.0")` and the `(protocolName, major,
minor, ...)` constructor with `"icap"` end up with `protocolName()`
containing U+0130 instead of plain ASCII `'I'`. The version no longer
matches its own canonical form.

The protocol grammars are ASCII-only (RFC 7230 §2.6 / RFC 2326 §1.4), so
the uppercase has no business consulting the JVM locale.

Pin every `String.toUpperCase()` in these three classes to `Locale.US`:

-
`codec-http/src/main/java/io/netty/handler/codec/http/HttpVersion.java`
- `(text, strict, keepAliveDefault)` constructor — line that normalizes
the supplied protocol string.
- `(protocolName, major, minor, keepAliveDefault, bytes)` constructor —
line that normalizes the supplied protocol name.
-
`codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspMethods.java`
- `valueOf(String name)` — line that normalizes the supplied RTSP method
name before the cache lookup.
-
`codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspVersions.java`
- `valueOf(String text)` — line that normalizes the supplied version
string before comparing to the cached `RTSP/1.0`.

`AsciiString.toUpperCase()` / `AsciiString.toLowerCase()` paths in the
same module are already ASCII-byte-level and not affected by this issue,
so they are left alone.


`codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java`:

| Change Point | Test |
|--------------|------|
| `HttpVersion.valueOf(text)` under Turkish locale |
`testLowercaseIotaProtocolNameUnderTurkishLocale` — installs
`Locale.setDefault(new Locale("tr","TR"))` (restored in `finally`) and
asserts `valueOf("icap/1.0")` returns a version whose `protocolName()`
is the ASCII `"ICAP"` and whose `text()` is `"ICAP/1.0"`. |
| `HttpVersion(protocolName, major, minor, ...)` under Turkish locale |
`testProtocolNameConstructorUnderTurkishLocale` — same locale setup,
asserts `new HttpVersion("icap", 1, 0, true)` ends up with
`protocolName()` = `"ICAP"` and `text()` = `"ICAP/1.0"`. |

New

`codec-http/src/test/java/io/netty/handler/codec/rtsp/RtspMethodsTest.java`:

| Change Point | Test |
|--------------|------|
| Cached uppercase lookup still works |
`valueOfReturnsCachedInstanceForUppercaseName` |
| Lowercase normalization under default locale |
`valueOfNormalizesLowercaseInputUnderUsLocale` |
| Lowercase normalization under Turkish locale |
`valueOfNormalizesLowercaseInputUnderTurkishLocale` — installs `tr_TR`,
calls `valueOf("describe")` and `valueOf("redirect")`, asserts both
resolve to the cached `DESCRIBE` / `REDIRECT` instances. |

All three Turkish-locale tests fail deterministically against the
unfixed code (one with a clean assertion failure, the `RtspMethods` one
with `IllegalArgumentException: Illegal character in HTTP Method:
0x130`) and pass after the `Locale.US` change.

Verification:

```
mvn -pl codec-http -am test -Dtest='HttpVersionParsingTest,RtspMethodsTest' -Dsurefire.failIfNoSpecifiedTests=false
```

- Behavior on en/CJK/most locales: unchanged (the previous
default-locale uppercase already produced ASCII).
- Behavior on Turkish (and other locales with non-ASCII case mappings,
e.g. Azerbaijani): RTSP method parsing and HTTP-derived version parsing
of lowercase or mixed-case inputs now succeed instead of throwing or
returning a U+0130-tainted result.
- API: no signature change. All callers continue to use
`valueOf(String)` / the existing constructors.
- Risk: bounded — `Locale.US` is the standard Netty pattern for
protocol-string normalization (see e.g.
`WebSocketClientHandshaker.java:761`).

Co-authored-by: Guimu <[email protected]>
chrisvest added a commit that referenced this pull request May 10, 2026
….US (#16769)

Auto-port of #16765 to 5.0
Cherry-picked commit: e6d7cf7

---
## Problem

`HttpVersion`, `RtspVersions` and `RtspMethods` all uppercase their
input via `String.toUpperCase()` without an explicit `Locale`. The JVM
default locale governs that call, and in Turkish (`tr_TR`) the ASCII
letter `'i'` uppercases to `'İ'` (U+0130), not `'I'`.

Concretely, on a Turkish-locale JVM:

- `RtspMethods.valueOf("describe")` produces `"DESCRİBE"` after the
uppercase, fails the cache lookup, falls through to
`HttpMethod.valueOf(...)`, and throws `IllegalArgumentException: Illegal
character in HTTP Method: 0x130` for what is otherwise a perfectly valid
RTSP method. Same for `"redirect"` (`REDİRECT`).
- `HttpVersion.valueOf("icap/1.0")` and the `(protocolName, major,
minor, ...)` constructor with `"icap"` end up with `protocolName()`
containing U+0130 instead of plain ASCII `'I'`. The version no longer
matches its own canonical form.

The protocol grammars are ASCII-only (RFC 7230 §2.6 / RFC 2326 §1.4), so
the uppercase has no business consulting the JVM locale.

## Fix

Pin every `String.toUpperCase()` in these three classes to `Locale.US`:

-
`codec-http/src/main/java/io/netty/handler/codec/http/HttpVersion.java`
- `(text, strict, keepAliveDefault)` constructor — line that normalizes
the supplied protocol string.
- `(protocolName, major, minor, keepAliveDefault, bytes)` constructor —
line that normalizes the supplied protocol name.
-
`codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspMethods.java`
- `valueOf(String name)` — line that normalizes the supplied RTSP method
name before the cache lookup.
-
`codec-http/src/main/java/io/netty/handler/codec/rtsp/RtspVersions.java`
- `valueOf(String text)` — line that normalizes the supplied version
string before comparing to the cached `RTSP/1.0`.

`AsciiString.toUpperCase()` / `AsciiString.toLowerCase()` paths in the
same module are already ASCII-byte-level and not affected by this issue,
so they are left alone.

## Tests


`codec-http/src/test/java/io/netty/handler/codec/http/HttpVersionParsingTest.java`:

| Change Point | Test |
|--------------|------|
| `HttpVersion.valueOf(text)` under Turkish locale |
`testLowercaseIotaProtocolNameUnderTurkishLocale` — installs
`Locale.setDefault(new Locale("tr","TR"))` (restored in `finally`) and
asserts `valueOf("icap/1.0")` returns a version whose `protocolName()`
is the ASCII `"ICAP"` and whose `text()` is `"ICAP/1.0"`. |
| `HttpVersion(protocolName, major, minor, ...)` under Turkish locale |
`testProtocolNameConstructorUnderTurkishLocale` — same locale setup,
asserts `new HttpVersion("icap", 1, 0, true)` ends up with
`protocolName()` = `"ICAP"` and `text()` = `"ICAP/1.0"`. |

New
`codec-http/src/test/java/io/netty/handler/codec/rtsp/RtspMethodsTest.java`:

| Change Point | Test |
|--------------|------|
| Cached uppercase lookup still works |
`valueOfReturnsCachedInstanceForUppercaseName` |
| Lowercase normalization under default locale |
`valueOfNormalizesLowercaseInputUnderUsLocale` |
| Lowercase normalization under Turkish locale |
`valueOfNormalizesLowercaseInputUnderTurkishLocale` — installs `tr_TR`,
calls `valueOf("describe")` and `valueOf("redirect")`, asserts both
resolve to the cached `DESCRIBE` / `REDIRECT` instances. |

All three Turkish-locale tests fail deterministically against the
unfixed code (one with a clean assertion failure, the `RtspMethods` one
with `IllegalArgumentException: Illegal character in HTTP Method:
0x130`) and pass after the `Locale.US` change.

Verification:

```
mvn -pl codec-http -am test -Dtest='HttpVersionParsingTest,RtspMethodsTest' -Dsurefire.failIfNoSpecifiedTests=false
# Tests run: 52, Failures: 0, Errors: 0, Skipped: 0
```

## Impact

- Behavior on en/CJK/most locales: unchanged (the previous
default-locale uppercase already produced ASCII).
- Behavior on Turkish (and other locales with non-ASCII case mappings,
e.g. Azerbaijani): RTSP method parsing and HTTP-derived version parsing
of lowercase or mixed-case inputs now succeed instead of throwing or
returning a U+0130-tainted result.
- API: no signature change. All callers continue to use
`valueOf(String)` / the existing constructors.
- Risk: bounded — `Locale.US` is the standard Netty pattern for
protocol-string normalization (see e.g.
`WebSocketClientHandshaker.java:761`).

Co-authored-by: Guimu <[email protected]>
Co-authored-by: Chris Vest <[email protected]>
normanmaurer added a commit that referenced this pull request May 10, 2026
…o Locale.US (#16768)

## Problem

Two spots in the HTTP multipart codec normalize a header value with
`String.toLowerCase()` without an explicit Locale, then compare the
result to lowercase ASCII constants. The JVM default Locale governs that
call, and on a Turkish (`tr_TR`) JVM the ASCII `'I'` lowercases to `'ı'`
(U+0131). A perfectly valid uppercase form silently misses the
comparison.

Concretely on a Turkish-locale JVM:

- `HttpPostMultipartRequestDecoder` decoding a part with
`Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 §6.1 says
mechanism tokens are case-insensitive) lowercases the value to
`"bınary"`, fails the equality check against the `binary` / `7bit` /
`8bit` constants, and throws `ErrorDataDecoderException:
TransferEncoding Unknown: bınary`.
- `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing
`Content-Type: MULTIPART/form-data; boundary=...` header (mixed case is
allowed by the Content-Type ABNF, RFC 7231 §3.1.1.1) lowercases the
value to `"multıpart/..."`, misses the
`startsWith("multipart/form-data")` check, and the original mixed-case
header survives alongside the freshly-built multipart Content-Type the
encoder is about to add. The outgoing request ends up with **two**
`Content-Type` headers.

The values being compared against are lowercase ASCII tokens and have no
business consulting the JVM locale.

## Fix

Pin both `String.toLowerCase()` calls to `Locale.US`:

-
`codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java`
— `getFileUpload(String delimiter)` lowercases the
`Content-Transfer-Encoding` value before matching it against `BIT7` /
`BIT8` / `BINARY` mechanism tokens.
-
`codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java`
— `finalizeRequest()` lowercases each existing `Content-Type` before
checking if it is the multipart or `application/x-www-form-urlencoded`
form (which the encoder is responsible for setting fresh).

## Tests

| Change Point | Test |
|--------------|------|
| Decoder Content-Transfer-Encoding lowercase under Turkish |
`HttpPostMultiPartRequestDecoderTest.testUppercaseBinaryTransferEncodingUnderTurkishLocale`
— installs the Turkish locale (restored in `finally`), feeds a multipart
body with `Content-Transfer-Encoding: BINARY`, and asserts the file part
decodes successfully. Without the fix this throws `TransferEncoding
Unknown: bınary`. |
| Encoder Content-Type lowercase under Turkish |
`HttpPostRequestEncoderTest.testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale`
— pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`,
runs the encoder under the Turkish locale, and asserts only one
Content-Type header survives. Without the fix the request ends up with
two Content-Type headers. |

Both tests fail deterministically on the unfixed code (one as an
assertion failure, the other as a thrown `ErrorDataDecoderException`)
and pass after the `Locale.US` change.

Verification:

```
mvn -pl codec-http -am test \
  -Dtest='HttpPostRequestEncoderTest#testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale,HttpPostMultiPartRequestDecoderTest#testUppercaseBinaryTransferEncodingUnderTurkishLocale' \
  -Dsurefire.failIfNoSpecifiedTests=false
# Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
```

## Impact

- Behavior on en/CJK/most locales: unchanged (the previous
default-locale lowercase already produced ASCII).
- Behavior on Turkish (and other locales with non-ASCII case mappings):
a multipart upload with uppercase `Content-Transfer-Encoding: BINARY`
now decodes instead of throwing; an outgoing multipart request with a
pre-existing mixed-case `Content-Type: MULTIPART/...` no longer leaks a
duplicate Content-Type header.
- API: no signature change. All callers continue through the existing
public API.
- Risk: bounded — `Locale.US` is the standard Netty pattern for
protocol-string normalization (see e.g.
`WebSocketClientHandshaker.java:761`).

Sibling fix to #16765, which pinned the same locale gotcha in
`HttpVersion`, `RtspMethods`, and `RtspVersions`.

---------

Co-authored-by: Norman Maurer <[email protected]>
normanmaurer added a commit that referenced this pull request May 11, 2026
#16784)

…o Locale.US (#16768)

Two spots in the HTTP multipart codec normalize a header value with
`String.toLowerCase()` without an explicit Locale, then compare the
result to lowercase ASCII constants. The JVM default Locale governs that
call, and on a Turkish (`tr_TR`) JVM the ASCII `'I'` lowercases to `'ı'`
(U+0131). A perfectly valid uppercase form silently misses the
comparison.

Concretely on a Turkish-locale JVM:

- `HttpPostMultipartRequestDecoder` decoding a part with
`Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 §6.1 says
mechanism tokens are case-insensitive) lowercases the value to
`"bınary"`, fails the equality check against the `binary` / `7bit` /
`8bit` constants, and throws `ErrorDataDecoderException:
TransferEncoding Unknown: bınary`.
- `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing
`Content-Type: MULTIPART/form-data; boundary=...` header (mixed case is
allowed by the Content-Type ABNF, RFC 7231 §3.1.1.1) lowercases the
value to `"multıpart/..."`, misses the
`startsWith("multipart/form-data")` check, and the original mixed-case
header survives alongside the freshly-built multipart Content-Type the
encoder is about to add. The outgoing request ends up with **two**
`Content-Type` headers.

The values being compared against are lowercase ASCII tokens and have no
business consulting the JVM locale.

Pin both `String.toLowerCase()` calls to `Locale.US`:

-

`codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java`
— `getFileUpload(String delimiter)` lowercases the
`Content-Transfer-Encoding` value before matching it against `BIT7` /
`BIT8` / `BINARY` mechanism tokens.
-

`codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java`
— `finalizeRequest()` lowercases each existing `Content-Type` before
checking if it is the multipart or `application/x-www-form-urlencoded`
form (which the encoder is responsible for setting fresh).

| Change Point | Test |
|--------------|------|
| Decoder Content-Transfer-Encoding lowercase under Turkish |
`HttpPostMultiPartRequestDecoderTest.testUppercaseBinaryTransferEncodingUnderTurkishLocale`
— installs the Turkish locale (restored in `finally`), feeds a multipart
body with `Content-Transfer-Encoding: BINARY`, and asserts the file part
decodes successfully. Without the fix this throws `TransferEncoding
Unknown: bınary`. |
| Encoder Content-Type lowercase under Turkish |

`HttpPostRequestEncoderTest.testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale`
— pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`,
runs the encoder under the Turkish locale, and asserts only one
Content-Type header survives. Without the fix the request ends up with
two Content-Type headers. |

Both tests fail deterministically on the unfixed code (one as an
assertion failure, the other as a thrown `ErrorDataDecoderException`)
and pass after the `Locale.US` change.

Verification:

```
mvn -pl codec-http -am test \
  -Dtest='HttpPostRequestEncoderTest#testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale,HttpPostMultiPartRequestDecoderTest#testUppercaseBinaryTransferEncodingUnderTurkishLocale' \
  -Dsurefire.failIfNoSpecifiedTests=false
```

- Behavior on en/CJK/most locales: unchanged (the previous
default-locale lowercase already produced ASCII).
- Behavior on Turkish (and other locales with non-ASCII case mappings):
a multipart upload with uppercase `Content-Transfer-Encoding: BINARY`
now decodes instead of throwing; an outgoing multipart request with a
pre-existing mixed-case `Content-Type: MULTIPART/...` no longer leaks a
duplicate Content-Type header.
- API: no signature change. All callers continue through the existing
public API.
- Risk: bounded — `Locale.US` is the standard Netty pattern for
protocol-string normalization (see e.g.
`WebSocketClientHandshaker.java:761`).

Sibling fix to #16765, which pinned the same locale gotcha in
`HttpVersion`, `RtspMethods`, and `RtspVersions`.

Co-authored-by: Guimu <[email protected]>
normanmaurer added a commit that referenced this pull request May 11, 2026
… case folding to Locale.US (#16782)

Auto-port of #16768 to 5.0
Cherry-picked commit: b9eacea

---
## Problem

Two spots in the HTTP multipart codec normalize a header value with
`String.toLowerCase()` without an explicit Locale, then compare the
result to lowercase ASCII constants. The JVM default Locale governs that
call, and on a Turkish (`tr_TR`) JVM the ASCII `'I'` lowercases to `'ı'`
(U+0131). A perfectly valid uppercase form silently misses the
comparison.

Concretely on a Turkish-locale JVM:

- `HttpPostMultipartRequestDecoder` decoding a part with
`Content-Transfer-Encoding: BINARY` (uppercase, RFC 2045 §6.1 says
mechanism tokens are case-insensitive) lowercases the value to
`"bınary"`, fails the equality check against the `binary` / `7bit` /
`8bit` constants, and throws `ErrorDataDecoderException:
TransferEncoding Unknown: bınary`.
- `HttpPostRequestEncoder.finalizeRequest()` skipping a pre-existing
`Content-Type: MULTIPART/form-data; boundary=...` header (mixed case is
allowed by the Content-Type ABNF, RFC 7231 §3.1.1.1) lowercases the
value to `"multıpart/..."`, misses the
`startsWith("multipart/form-data")` check, and the original mixed-case
header survives alongside the freshly-built multipart Content-Type the
encoder is about to add. The outgoing request ends up with **two**
`Content-Type` headers.

The values being compared against are lowercase ASCII tokens and have no
business consulting the JVM locale.

## Fix

Pin both `String.toLowerCase()` calls to `Locale.US`:

-
`codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java`
— `getFileUpload(String delimiter)` lowercases the
`Content-Transfer-Encoding` value before matching it against `BIT7` /
`BIT8` / `BINARY` mechanism tokens.
-
`codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostRequestEncoder.java`
— `finalizeRequest()` lowercases each existing `Content-Type` before
checking if it is the multipart or `application/x-www-form-urlencoded`
form (which the encoder is responsible for setting fresh).

## Tests

| Change Point | Test |
|--------------|------|
| Decoder Content-Transfer-Encoding lowercase under Turkish |
`HttpPostMultiPartRequestDecoderTest.testUppercaseBinaryTransferEncodingUnderTurkishLocale`
— installs the Turkish locale (restored in `finally`), feeds a multipart
body with `Content-Transfer-Encoding: BINARY`, and asserts the file part
decodes successfully. Without the fix this throws `TransferEncoding
Unknown: bınary`. |
| Encoder Content-Type lowercase under Turkish |
`HttpPostRequestEncoderTest.testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale`
— pre-sets `Content-Type: MULTIPART/form-data; boundary=preexisting`,
runs the encoder under the Turkish locale, and asserts only one
Content-Type header survives. Without the fix the request ends up with
two Content-Type headers. |

Both tests fail deterministically on the unfixed code (one as an
assertion failure, the other as a thrown `ErrorDataDecoderException`)
and pass after the `Locale.US` change.

Verification:

```
mvn -pl codec-http -am test \
  -Dtest='HttpPostRequestEncoderTest#testFinalizeRemovesPreexistingMultipartContentTypeUnderTurkishLocale,HttpPostMultiPartRequestDecoderTest#testUppercaseBinaryTransferEncodingUnderTurkishLocale' \
  -Dsurefire.failIfNoSpecifiedTests=false
# Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
```

## Impact

- Behavior on en/CJK/most locales: unchanged (the previous
default-locale lowercase already produced ASCII).
- Behavior on Turkish (and other locales with non-ASCII case mappings):
a multipart upload with uppercase `Content-Transfer-Encoding: BINARY`
now decodes instead of throwing; an outgoing multipart request with a
pre-existing mixed-case `Content-Type: MULTIPART/...` no longer leaks a
duplicate Content-Type header.
- API: no signature change. All callers continue through the existing
public API.
- Risk: bounded — `Locale.US` is the standard Netty pattern for
protocol-string normalization (see e.g.
`WebSocketClientHandshaker.java:761`).

Sibling fix to #16765, which pinned the same locale gotcha in
`HttpVersion`, `RtspMethods`, and `RtspVersions`.

Co-authored-by: Guimu <[email protected]>
Co-authored-by: Norman Maurer <[email protected]>
@chrisvest chrisvest removed the needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. label May 12, 2026
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request May 24, 2026
…ip ci]

Bumps `netty.version` from 4.2.13.Final to 4.2.14.Final.
Updates `io.netty:netty-transport` from 4.2.13.Final to 4.2.14.Final
Release notes

*Sourced from [io.netty:netty-transport's releases](https://github.com/netty/netty/releases).*

> netty-4.2.14.Final
> ------------------
>
> What's Changed
> --------------
>
> * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748)
> * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747)
> * Marshalling: Explicit document security requirements by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752)
> * Fix io\_uring op completion TRACE logging by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755)
> * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758)
> * Avoid re-parsing openssl key material with non-cached provider by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759)
> * Pin HTTP/RTSP version + method normalization to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765)
> * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@​tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764)
> * Revapi: Use default "oldVersion" by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774)
> * Adaptive: Fix concurrency issue in adaptive allocator by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767)
> * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781)
> * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768)
> * Remove dead native declarations by [`@​pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * Isolate tests that modify available Security providers by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793)
> * Remove test annotations from a method that isn't a test by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792)
> * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@​zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * IoUring: extend user data from short to long by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682)
> * Revert CompositeByteBuf component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811)
> * HTTP2: Use 100 as default max concurrent streams setting by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804)
> * Fix ResumptionController wrapping by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815)
> * Resolve all localhost addresses without querying DNS servers by [`@​JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803)
> * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788)
> * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@​kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@​LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826)
> * MQTT: Allow MQTT 5 CONNECT with password only by [`@​shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
> * Fix MQTT decoder size check after variable header replay by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787)
>
> New Contributors
> ----------------
>
> * [`@​pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * [`@​zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * [`@​JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * [`@​kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * [`@​shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
>
> **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final>


Commits

* [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final
* [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787))
* [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833))
* [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(...
* [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794))
* [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe...
* [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ...
* [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749))
* [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815))
* [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804))
* Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final)
  
Updates `io.netty:netty-codec` from 4.2.13.Final to 4.2.14.Final
Release notes

*Sourced from [io.netty:netty-codec's releases](https://github.com/netty/netty/releases).*

> netty-4.2.14.Final
> ------------------
>
> What's Changed
> --------------
>
> * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748)
> * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747)
> * Marshalling: Explicit document security requirements by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752)
> * Fix io\_uring op completion TRACE logging by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755)
> * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758)
> * Avoid re-parsing openssl key material with non-cached provider by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759)
> * Pin HTTP/RTSP version + method normalization to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765)
> * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@​tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764)
> * Revapi: Use default "oldVersion" by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774)
> * Adaptive: Fix concurrency issue in adaptive allocator by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767)
> * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781)
> * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768)
> * Remove dead native declarations by [`@​pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * Isolate tests that modify available Security providers by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793)
> * Remove test annotations from a method that isn't a test by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792)
> * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@​zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * IoUring: extend user data from short to long by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682)
> * Revert CompositeByteBuf component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811)
> * HTTP2: Use 100 as default max concurrent streams setting by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804)
> * Fix ResumptionController wrapping by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815)
> * Resolve all localhost addresses without querying DNS servers by [`@​JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803)
> * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788)
> * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@​kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@​LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826)
> * MQTT: Allow MQTT 5 CONNECT with password only by [`@​shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
> * Fix MQTT decoder size check after variable header replay by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787)
>
> New Contributors
> ----------------
>
> * [`@​pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * [`@​zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * [`@​JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * [`@​kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * [`@​shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
>
> **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final>


Commits

* [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final
* [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787))
* [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833))
* [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(...
* [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794))
* [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe...
* [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ...
* [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749))
* [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815))
* [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804))
* Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final)
  
Updates `io.netty:netty-handler` from 4.2.13.Final to 4.2.14.Final
Release notes

*Sourced from [io.netty:netty-handler's releases](https://github.com/netty/netty/releases).*

> netty-4.2.14.Final
> ------------------
>
> What's Changed
> --------------
>
> * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748)
> * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747)
> * Marshalling: Explicit document security requirements by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752)
> * Fix io\_uring op completion TRACE logging by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755)
> * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758)
> * Avoid re-parsing openssl key material with non-cached provider by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759)
> * Pin HTTP/RTSP version + method normalization to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765)
> * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@​tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764)
> * Revapi: Use default "oldVersion" by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774)
> * Adaptive: Fix concurrency issue in adaptive allocator by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767)
> * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781)
> * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768)
> * Remove dead native declarations by [`@​pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * Isolate tests that modify available Security providers by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793)
> * Remove test annotations from a method that isn't a test by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792)
> * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@​zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * IoUring: extend user data from short to long by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682)
> * Revert CompositeByteBuf component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811)
> * HTTP2: Use 100 as default max concurrent streams setting by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804)
> * Fix ResumptionController wrapping by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815)
> * Resolve all localhost addresses without querying DNS servers by [`@​JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803)
> * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788)
> * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@​kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@​LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826)
> * MQTT: Allow MQTT 5 CONNECT with password only by [`@​shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
> * Fix MQTT decoder size check after variable header replay by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787)
>
> New Contributors
> ----------------
>
> * [`@​pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * [`@​zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * [`@​JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * [`@​kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * [`@​shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
>
> **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final>


Commits

* [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final
* [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787))
* [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833))
* [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(...
* [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794))
* [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe...
* [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ...
* [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749))
* [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815))
* [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804))
* Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request May 24, 2026
…l [skip ci]

Bumps [io.netty:netty-all](https://github.com/netty/netty) from 4.2.13.Final to 4.2.14.Final.
Release notes

*Sourced from [io.netty:netty-all's releases](https://github.com/netty/netty/releases).*

> netty-4.2.14.Final
> ------------------
>
> What's Changed
> --------------
>
> * HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16748](https://redirect.github.com/netty/netty/pull/16748)
> * HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16747](https://redirect.github.com/netty/netty/pull/16747)
> * Marshalling: Explicit document security requirements by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16752](https://redirect.github.com/netty/netty/pull/16752)
> * Fix io\_uring op completion TRACE logging by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16755](https://redirect.github.com/netty/netty/pull/16755)
> * Quic: Ensure writes are done before notify close promise of QuicheQui… by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16758](https://redirect.github.com/netty/netty/pull/16758)
> * Avoid re-parsing openssl key material with non-cached provider by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16759](https://redirect.github.com/netty/netty/pull/16759)
> * Pin HTTP/RTSP version + method normalization to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16765](https://redirect.github.com/netty/netty/pull/16765)
> * Fill MsgHdrMemoryArray#hdrs with null entry on release by [`@​tsegismont`](https://github.com/tsegismont) in [netty/netty#16764](https://redirect.github.com/netty/netty/pull/16764)
> * Revapi: Use default "oldVersion" by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16774](https://redirect.github.com/netty/netty/pull/16774)
> * Adaptive: Fix concurrency issue in adaptive allocator by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16767](https://redirect.github.com/netty/netty/pull/16767)
> * Auto-port 4.2: Make bulk byte moving in ByteBuf faster by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16781](https://redirect.github.com/netty/netty/pull/16781)
> * Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16768](https://redirect.github.com/netty/netty/pull/16768)
> * Remove dead native declarations by [`@​pandareen`](https://github.com/pandareen) in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * Isolate tests that modify available Security providers by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16793](https://redirect.github.com/netty/netty/pull/16793)
> * Remove test annotations from a method that isn't a test by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16792](https://redirect.github.com/netty/netty/pull/16792)
> * Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by [`@​zhangweikop`](https://github.com/zhangweikop) in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * IoUring: extend user data from short to long by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16682](https://redirect.github.com/netty/netty/pull/16682)
> * Revert CompositeByteBuf component search fast path by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16811](https://redirect.github.com/netty/netty/pull/16811)
> * HTTP2: Use 100 as default max concurrent streams setting by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16804](https://redirect.github.com/netty/netty/pull/16804)
> * Fix ResumptionController wrapping by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16815](https://redirect.github.com/netty/netty/pull/16815)
> * Resolve all localhost addresses without querying DNS servers by [`@​JulianVennen`](https://github.com/JulianVennen) in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by [`@​normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16803](https://redirect.github.com/netty/netty/pull/16803)
> * Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16788](https://redirect.github.com/netty/netty/pull/16788)
> * Route synchronous onLookupComplete exceptions via fireExceptionCaught by [`@​kwondh5217`](https://github.com/kwondh5217) in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by [`@​LuciferYang`](https://github.com/LuciferYang) in [netty/netty#16826](https://redirect.github.com/netty/netty/pull/16826)
> * MQTT: Allow MQTT 5 CONNECT with password only by [`@​shblue21`](https://github.com/shblue21) in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
> * Fix MQTT decoder size check after variable header replay by [`@​daguimu`](https://github.com/daguimu) in [netty/netty#16787](https://redirect.github.com/netty/netty/pull/16787)
>
> New Contributors
> ----------------
>
> * [`@​pandareen`](https://github.com/pandareen) made their first contribution in [netty/netty#16783](https://redirect.github.com/netty/netty/pull/16783)
> * [`@​zhangweikop`](https://github.com/zhangweikop) made their first contribution in [netty/netty#16523](https://redirect.github.com/netty/netty/pull/16523)
> * [`@​JulianVennen`](https://github.com/JulianVennen) made their first contribution in [netty/netty#16749](https://redirect.github.com/netty/netty/pull/16749)
> * [`@​kwondh5217`](https://github.com/kwondh5217) made their first contribution in [netty/netty#16794](https://redirect.github.com/netty/netty/pull/16794)
> * [`@​shblue21`](https://github.com/shblue21) made their first contribution in [netty/netty#16833](https://redirect.github.com/netty/netty/pull/16833)
>
> **Full Changelog**: <netty/netty@netty-4.2.13.Final...netty-4.2.14.Final>


Commits

* [`0a60b75`](netty/netty@0a60b75) [maven-release-plugin] prepare release netty-4.2.14.Final
* [`72df658`](netty/netty@72df658) Fix MQTT decoder size check after variable header replay ([#16787](https://redirect.github.com/netty/netty/issues/16787))
* [`7125dba`](netty/netty@7125dba) MQTT: Allow MQTT 5 CONNECT with password only ([#16833](https://redirect.github.com/netty/netty/issues/16833))
* [`9e19320`](netty/netty@9e19320) IoUring: Stop generic FileRegion drain loop when transferred() reaches count(...
* [`4ce9f17`](netty/netty@4ce9f17) Route synchronous onLookupComplete exceptions via fireExceptionCaught ([#16794](https://redirect.github.com/netty/netty/issues/16794))
* [`f7b1b7d`](netty/netty@f7b1b7d) Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe...
* [`0ccb265`](netty/netty@0ccb265) IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ...
* [`a6aeb6d`](netty/netty@a6aeb6d) Resolve all localhost addresses without querying DNS servers ([#16749](https://redirect.github.com/netty/netty/issues/16749))
* [`c328ba2`](netty/netty@c328ba2) Fix ResumptionController wrapping ([#16815](https://redirect.github.com/netty/netty/issues/16815))
* [`bc5862b`](netty/netty@bc5862b) HTTP2: Use 100 as default max concurrent streams setting ([#16804](https://redirect.github.com/netty/netty/issues/16804))
* Additional commits viewable in [compare view](netty/netty@netty-4.2.13.Final...netty-4.2.14.Final)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=io.netty:netty-all&package-manager=maven&previous-version=4.2.13.Final&new-version=4.2.14.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants