…ory allocation (#16894)

Auto-port of #16850 to 4.1
Cherry-picked commit: 0bd1657

---
Motivation:
The ZstdDecoder does not currently constrain the memory the underlying
zstd decoder may allocate per stream. RFC 8478 ("Security
Considerations") states:
An attacker may provide correctly formed compressed frames with
unreasonable memory requirements. A decoder must always control memory
requirements and enforce some (system-specific) limits in order to
protect memory usage from such scenarios.
The most common instance of this attack is a tiny (a few hundred bytes)
Zstandard frame whose header declares a very large Window_Size — for
example Window_Log = 31, a 2 GiB sliding window. When such a frame is
fed to libzstd, the declared window is allocated as native memory before
any actual content is decoded, so a handful of concurrent connections is
enough to drive a server into OOM. This is exactly the class of
"unreasonable memory requirements" calls out.
The libzstd manual exposes a parameter (ZSTD_d_windowLogMax)
specifically to bound this, and zstd-jni surfaces it via
ZstdInputStreamNoFinalizer.setLongMax(int). The fix is to wire it up in
ZstdDecoder with a sensible default. Note that the existing
maximumAllocationSize parameter only caps the Netty-side output buffer
handed to the next handler; it does not bound the native window memory
libzstd allocates, so the attack surface remained open prior to this
change.
Modification:
Add a new public constant DEFAULT_MAX_WINDOW_LOG = 27 (128 MiB window),
a reasonable default for general-purpose server use that still leaves
significant headroom for typical zstd CLI output (whose default
Window_Log is ≤ 23).
Add a new constructor ZstdDecoder(int maximumAllocationSize, int
maxWindowLog). maxWindowLog is validated to be in [10, 31] per RFC 8478.
The existing ZstdDecoder(int maximumAllocationSize) constructor now
delegates to the new one with DEFAULT_MAX_WINDOW_LOG, so the default
behavior of existing call sites is preserved at the API level while no
longer being vulnerable to the attack above.
In handlerAdded, after the existing setContinuous(true), call
zstdIs.setLongMax(maxWindowLog). Frames whose Window_Log exceeds the
configured cap are rejected by libzstd with a ZstdIOException("Frame
requires too much memory for decoding"), which the existing catch
(Exception e) path wraps into a DecompressionException and transitions
the handler to CORRUPTED.

Result:
Fixes #.
ZstdDecoder now controls the per-stream native window memory libzstd
will allocate, addressing the "unreasonable memory requirements"
scenario in RFC 8478. Users who legitimately need to accept frames with
very large windows can opt in via the new constructor with a larger
maxWindowLog.

---------

Co-authored-by: skyguard1 <[email protected]>
Co-authored-by: Chris Vest <[email protected]>
Co-authored-by: Norman Maurer <[email protected]>

…ory allocation (#16895)

Auto-port of #16850 to 5.0
Cherry-picked commit: 0bd1657

---
Motivation:
The ZstdDecoder does not currently constrain the memory the underlying
zstd decoder may allocate per stream. RFC 8478 ("Security
Considerations") states:
An attacker may provide correctly formed compressed frames with
unreasonable memory requirements. A decoder must always control memory
requirements and enforce some (system-specific) limits in order to
protect memory usage from such scenarios.
The most common instance of this attack is a tiny (a few hundred bytes)
Zstandard frame whose header declares a very large Window_Size — for
example Window_Log = 31, a 2 GiB sliding window. When such a frame is
fed to libzstd, the declared window is allocated as native memory before
any actual content is decoded, so a handful of concurrent connections is
enough to drive a server into OOM. This is exactly the class of
"unreasonable memory requirements" calls out.
The libzstd manual exposes a parameter (ZSTD_d_windowLogMax)
specifically to bound this, and zstd-jni surfaces it via
ZstdInputStreamNoFinalizer.setLongMax(int). The fix is to wire it up in
ZstdDecoder with a sensible default. Note that the existing
maximumAllocationSize parameter only caps the Netty-side output buffer
handed to the next handler; it does not bound the native window memory
libzstd allocates, so the attack surface remained open prior to this
change.
Modification:
Add a new public constant DEFAULT_MAX_WINDOW_LOG = 27 (128 MiB window),
a reasonable default for general-purpose server use that still leaves
significant headroom for typical zstd CLI output (whose default
Window_Log is ≤ 23).
Add a new constructor ZstdDecoder(int maximumAllocationSize, int
maxWindowLog). maxWindowLog is validated to be in [10, 31] per RFC 8478.
The existing ZstdDecoder(int maximumAllocationSize) constructor now
delegates to the new one with DEFAULT_MAX_WINDOW_LOG, so the default
behavior of existing call sites is preserved at the API level while no
longer being vulnerable to the attack above.
In handlerAdded, after the existing setContinuous(true), call
zstdIs.setLongMax(maxWindowLog). Frames whose Window_Log exceeds the
configured cap are rejected by libzstd with a ZstdIOException("Frame
requires too much memory for decoding"), which the existing catch
(Exception e) path wraps into a DecompressionException and transitions
the handler to CORRUPTED.

Result:
Fixes #.
ZstdDecoder now controls the per-stream native window memory libzstd
will allocate, addressing the "unreasonable memory requirements"
scenario in RFC 8478. Users who legitimately need to accept frames with
very large windows can opt in via the new constructor with a larger
maxWindowLog.

---------

Co-authored-by: skyguard1 <[email protected]>
Co-authored-by: Chris Vest <[email protected]>

### What changes were proposed in this pull request?

This PR aims to upgrade `Netty` to 4.2.15.Final.

### Why are the changes needed?

To bring the latest bug fixes:

- https://netty.io/news/2026/06/01/4-2-15-Final.html
  - [CVE-2026-48059](GHSA-h2qv-fj59-j46j): memory exhaustion in io.netty:netty-codec-haproxy (high).
  - [CVE-2026-47691](GHSA-5pvg-856g-cp85): DNS cache poisoning in io.netty:netty-resolver-dns (high).
  - [CVE-2026-XXXXX](https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm): DDoS in io.netty:netty-codec-http2.
  - [CVE-2026-XXXXX](GHSA-5w86-c3rq-vjj7): memory exhaustion in io.netty:netty-codec-redis (high).
  - [CVE-2026-44250](GHSA-3244-j874-rhc2): memory exhaustion in io.netty:netty-codec-redis (high).
  - [CVE-2026-44890](GHSA-6ghj-frrj-jjj3): memory exhaustion in io.netty:netty-codec-redis (high).
  - [CVE-2026-XXXXX](GHSA-cq4q-cv5g-r8q5): information disclosure and denial of service in io.netty:netty-codec-classes-quic.
  - [CVE-2026-44249](GHSA-3qp7-7mw8-wx86): IPv6 subnet filter bypass in io.netty:netty-handler (high).
  - [CVE-2026-XXXXX](GHSA-hvcg-qmg6-jm4c): request smuggling in io.netty:netty-codec-http.
  - [CVE-2026-44892](GHSA-c2rx-5r8w-8xr2): memory exhaustion in io.netty:netty-codec-http3 (high).
  - [CVE-2026-44893](GHSA-cc37-9q2j-3hfv): memory leak in io.netty:netty-codec-haproxy (high).
  - [CVE-2026-44894](GHSA-cmm3-54f8-px4j): traffic amplification in io.netty:netty-codec-classes-quic (high).
  - [CVE-2026-XXXXX](GHSA-c653-97m9-rcg9): TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
  - [CVE-2026-45673](GHSA-xmv7-r254-6q78): DNS cache poisoning in io.netty:netty-resolver-dns.
  - [CVE-2026-45416](GHSA-x4gw-5cx5-pgmh): excessive memory usage from SNIHandler in io.netty:netty-handler (high).
  - [CVE-2026-45536](GHSA-w573-9ffj-6ff9): file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.
  - [CVE-2026-45674](GHSA-676x-f7gg-47vc): DNS cache poisoning in io.netty:netty-resolver-dns (high).
  - [CVE-2026-46340](GHSA-5xrh-qmmq-w6ch): memory exhaustion in io.netty:netty-transport-sctp (high).
  - [CVE-2026-47244](GHSA-5x3r-wrvg-rp6q): denial of service in io.netty:netty-codec-http2.
  - [CVE-2026-48006](GHSA-6jv9-x5w9-2ccm): memory exhaustion in io.netty:netty-codec-redis (high).
  - [CVE-2026-48748](GHSA-4grm-h2qv-h6w6): memory exhaustion in io.netty:netty-codec-http3 (high).
  - [CVE-2026-48043](GHSA-c2gf-v879-257j): memory exhaustion in io.netty:netty-codec-http2.
  - Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup [#16836](netty/netty#16836)
  - HTTP/2: Parse request-target path like Vert.x [#16810](netty/netty#16810)
  - ChannelInitializer: correct misleading comment on exceptionCaught route [#16853](netty/netty#16853)
  - FlowControlHandler: Suppress duplicate channelReadComplete after draining queue [#16837](netty/netty#16837)
  - Pass maxAllocation to Brotli and Zstd decoders [#16844](netty/netty#16844)
  - Add maxWindowLog parameter to ZstdDecoder to bound memory allocation [#16850](netty/netty#16850)
  - MQTT: Reject malformed no-payload packets with non-zero Remaining Length [#16890](netty/netty#16890)

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Pass the CIs.

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Opus 4.8

Closes #700 from dongjoon-hyun/SPARK-57272.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>

…ip ci]

Bumps `netty.version` from 4.2.14.Final to 4.2.15.Final.
Updates `io.netty:netty-transport` from 4.2.14.Final to 4.2.15.Final
Release notes

*Sourced from [io.netty:netty-transport's releases](https://github.com/netty/netty/releases).*

> netty-4.2.15.Final
> ------------------
>
> Security fixes
> --------------
>
> * [CVE-2026-48059](GHSA-h2qv-fj59-j46j): memory exhaustion in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-47691](GHSA-5pvg-856g-cp85): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-XXXXX](https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm): DDoS in `io.netty:netty-codec-http2`.
> * [CVE-2026-50011](GHSA-5w86-c3rq-vjj7): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44250](GHSA-3244-j874-rhc2): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44890](GHSA-6ghj-frrj-jjj3): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-50009](GHSA-cq4q-cv5g-r8q5): information disclosure and denial of service in `io.netty:netty-codec-classes-quic`.
> * [CVE-2026-44249](GHSA-3qp7-7mw8-wx86): IPv6 subnet filter bypass in `io.netty:netty-handler` (high).
> * [CVE-2026-50020](GHSA-hvcg-qmg6-jm4c): request smuggling in `io.netty:netty-codec-http`.
> * [CVE-2026-44892](GHSA-c2rx-5r8w-8xr2): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-44893](GHSA-cc37-9q2j-3hfv): memory leak in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-44894](GHSA-cmm3-54f8-px4j): traffic amplification in `io.netty:netty-codec-classes-quic` (high).
> * [CVE-2026-50010](GHSA-c653-97m9-rcg9): TLS hostname verification accidentally disabled in `io.netty:netty-handler` (high).
> * [CVE-2026-45673](GHSA-xmv7-r254-6q78): DNS cache poisoning in `io.netty:netty-resolver-dns`.
> * [CVE-2026-45416](GHSA-x4gw-5cx5-pgmh): excessive memory usage from SNIHandler in `io.netty:netty-handler` (high).
> * [CVE-2026-45536](GHSA-w573-9ffj-6ff9): file descriptor leak in `io.netty:netty-transport-native-epoll` and `io.netty:netty-transport-native-kqueue`.
> * [CVE-2026-45674](GHSA-676x-f7gg-47vc): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-46340](GHSA-5xrh-qmmq-w6ch): memory exhaustion in `io.netty:netty-transport-sctp` (high).
> * [CVE-2026-47244](GHSA-5x3r-wrvg-rp6q): denial of service in `io.netty:netty-codec-http2`.
> * [CVE-2026-48006](GHSA-6jv9-x5w9-2ccm): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-48748](GHSA-4grm-h2qv-h6w6): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-48043](GHSA-c2gf-v879-257j): memory exhaustion in `io.netty:netty-codec-http2`.
>
> What's Changed
> --------------
>
> * Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16836](https://redirect.github.com/netty/netty/pull/16836)
> * HTTP/2: Parse request-target path like Vert.x by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16810](https://redirect.github.com/netty/netty/pull/16810)
> * Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16853](https://redirect.github.com/netty/netty/pull/16853)
> * FlowControlHandler: Suppress duplicate channelReadComplete after draining queue ([#15053](https://redirect.github.com/netty/netty/issues/15053)) by [`@​schiemon`](https://github.com/schiemon) in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * Pass maxAllocation to Brotli and Zstd decoders by [`@​fedinskiy`](https://github.com/fedinskiy) in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
> * Fix revapi warnings by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16885](https://redirect.github.com/netty/netty/pull/16885)
> * Fix SCTP and Redis tests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16893](https://redirect.github.com/netty/netty/pull/16893)
> * Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by [`@​skyguard1`](https://github.com/skyguard1) in [netty/netty#16850](https://redirect.github.com/netty/netty/pull/16850)
> * Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16890](https://redirect.github.com/netty/netty/pull/16890)
>
> New Contributors
> ----------------
>
> * [`@​schiemon`](https://github.com/schiemon) made their first contribution in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * [`@​fedinskiy`](https://github.com/fedinskiy) made their first contribution in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
>
> **Full Changelog**: <netty/netty@netty-4.2.14.Final...netty-4.2.15.Final>


Commits

* [`a41f7b2`](netty/netty@a41f7b2) [maven-release-plugin] prepare release netty-4.2.15.Final
* [`2394530`](netty/netty@2394530) Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
* [`0bd1657`](netty/netty@0bd1657) Add maxWindowLog parameter to ZstdDecoder to bound memory allocation ([#16850](https://redirect.github.com/netty/netty/issues/16850))
* [`76291f5`](netty/netty@76291f5) Fix SCTP and Redis tests ([#16893](https://redirect.github.com/netty/netty/issues/16893))
* [`e067b6e`](netty/netty@e067b6e) Fix revapi warnings ([#16885](https://redirect.github.com/netty/netty/issues/16885))
* [`5a52600`](netty/netty@5a52600) Pass maxAllocation to Brotli and Zstd decoders ([#16844](https://redirect.github.com/netty/netty/issues/16844))
* [`541add0`](netty/netty@541add0) Merge commit from fork
* [`270800e`](netty/netty@270800e) Merge commit from fork
* [`3d45a1e`](netty/netty@3d45a1e) Merge commit from fork
* [`75127ca`](netty/netty@75127ca) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.14.Final...netty-4.2.15.Final)
  
Updates `io.netty:netty-codec` from 4.2.14.Final to 4.2.15.Final
Release notes

*Sourced from [io.netty:netty-codec's releases](https://github.com/netty/netty/releases).*

> netty-4.2.15.Final
> ------------------
>
> Security fixes
> --------------
>
> * [CVE-2026-48059](GHSA-h2qv-fj59-j46j): memory exhaustion in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-47691](GHSA-5pvg-856g-cp85): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-XXXXX](https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm): DDoS in `io.netty:netty-codec-http2`.
> * [CVE-2026-50011](GHSA-5w86-c3rq-vjj7): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44250](GHSA-3244-j874-rhc2): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44890](GHSA-6ghj-frrj-jjj3): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-50009](GHSA-cq4q-cv5g-r8q5): information disclosure and denial of service in `io.netty:netty-codec-classes-quic`.
> * [CVE-2026-44249](GHSA-3qp7-7mw8-wx86): IPv6 subnet filter bypass in `io.netty:netty-handler` (high).
> * [CVE-2026-50020](GHSA-hvcg-qmg6-jm4c): request smuggling in `io.netty:netty-codec-http`.
> * [CVE-2026-44892](GHSA-c2rx-5r8w-8xr2): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-44893](GHSA-cc37-9q2j-3hfv): memory leak in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-44894](GHSA-cmm3-54f8-px4j): traffic amplification in `io.netty:netty-codec-classes-quic` (high).
> * [CVE-2026-50010](GHSA-c653-97m9-rcg9): TLS hostname verification accidentally disabled in `io.netty:netty-handler` (high).
> * [CVE-2026-45673](GHSA-xmv7-r254-6q78): DNS cache poisoning in `io.netty:netty-resolver-dns`.
> * [CVE-2026-45416](GHSA-x4gw-5cx5-pgmh): excessive memory usage from SNIHandler in `io.netty:netty-handler` (high).
> * [CVE-2026-45536](GHSA-w573-9ffj-6ff9): file descriptor leak in `io.netty:netty-transport-native-epoll` and `io.netty:netty-transport-native-kqueue`.
> * [CVE-2026-45674](GHSA-676x-f7gg-47vc): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-46340](GHSA-5xrh-qmmq-w6ch): memory exhaustion in `io.netty:netty-transport-sctp` (high).
> * [CVE-2026-47244](GHSA-5x3r-wrvg-rp6q): denial of service in `io.netty:netty-codec-http2`.
> * [CVE-2026-48006](GHSA-6jv9-x5w9-2ccm): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-48748](GHSA-4grm-h2qv-h6w6): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-48043](GHSA-c2gf-v879-257j): memory exhaustion in `io.netty:netty-codec-http2`.
>
> What's Changed
> --------------
>
> * Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16836](https://redirect.github.com/netty/netty/pull/16836)
> * HTTP/2: Parse request-target path like Vert.x by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16810](https://redirect.github.com/netty/netty/pull/16810)
> * Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16853](https://redirect.github.com/netty/netty/pull/16853)
> * FlowControlHandler: Suppress duplicate channelReadComplete after draining queue ([#15053](https://redirect.github.com/netty/netty/issues/15053)) by [`@​schiemon`](https://github.com/schiemon) in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * Pass maxAllocation to Brotli and Zstd decoders by [`@​fedinskiy`](https://github.com/fedinskiy) in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
> * Fix revapi warnings by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16885](https://redirect.github.com/netty/netty/pull/16885)
> * Fix SCTP and Redis tests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16893](https://redirect.github.com/netty/netty/pull/16893)
> * Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by [`@​skyguard1`](https://github.com/skyguard1) in [netty/netty#16850](https://redirect.github.com/netty/netty/pull/16850)
> * Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16890](https://redirect.github.com/netty/netty/pull/16890)
>
> New Contributors
> ----------------
>
> * [`@​schiemon`](https://github.com/schiemon) made their first contribution in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * [`@​fedinskiy`](https://github.com/fedinskiy) made their first contribution in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
>
> **Full Changelog**: <netty/netty@netty-4.2.14.Final...netty-4.2.15.Final>


Commits

* [`a41f7b2`](netty/netty@a41f7b2) [maven-release-plugin] prepare release netty-4.2.15.Final
* [`2394530`](netty/netty@2394530) Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
* [`0bd1657`](netty/netty@0bd1657) Add maxWindowLog parameter to ZstdDecoder to bound memory allocation ([#16850](https://redirect.github.com/netty/netty/issues/16850))
* [`76291f5`](netty/netty@76291f5) Fix SCTP and Redis tests ([#16893](https://redirect.github.com/netty/netty/issues/16893))
* [`e067b6e`](netty/netty@e067b6e) Fix revapi warnings ([#16885](https://redirect.github.com/netty/netty/issues/16885))
* [`5a52600`](netty/netty@5a52600) Pass maxAllocation to Brotli and Zstd decoders ([#16844](https://redirect.github.com/netty/netty/issues/16844))
* [`541add0`](netty/netty@541add0) Merge commit from fork
* [`270800e`](netty/netty@270800e) Merge commit from fork
* [`3d45a1e`](netty/netty@3d45a1e) Merge commit from fork
* [`75127ca`](netty/netty@75127ca) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.14.Final...netty-4.2.15.Final)
  
Updates `io.netty:netty-handler` from 4.2.14.Final to 4.2.15.Final
Release notes

*Sourced from [io.netty:netty-handler's releases](https://github.com/netty/netty/releases).*

> netty-4.2.15.Final
> ------------------
>
> Security fixes
> --------------
>
> * [CVE-2026-48059](GHSA-h2qv-fj59-j46j): memory exhaustion in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-47691](GHSA-5pvg-856g-cp85): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-XXXXX](https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm): DDoS in `io.netty:netty-codec-http2`.
> * [CVE-2026-50011](GHSA-5w86-c3rq-vjj7): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44250](GHSA-3244-j874-rhc2): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44890](GHSA-6ghj-frrj-jjj3): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-50009](GHSA-cq4q-cv5g-r8q5): information disclosure and denial of service in `io.netty:netty-codec-classes-quic`.
> * [CVE-2026-44249](GHSA-3qp7-7mw8-wx86): IPv6 subnet filter bypass in `io.netty:netty-handler` (high).
> * [CVE-2026-50020](GHSA-hvcg-qmg6-jm4c): request smuggling in `io.netty:netty-codec-http`.
> * [CVE-2026-44892](GHSA-c2rx-5r8w-8xr2): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-44893](GHSA-cc37-9q2j-3hfv): memory leak in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-44894](GHSA-cmm3-54f8-px4j): traffic amplification in `io.netty:netty-codec-classes-quic` (high).
> * [CVE-2026-50010](GHSA-c653-97m9-rcg9): TLS hostname verification accidentally disabled in `io.netty:netty-handler` (high).
> * [CVE-2026-45673](GHSA-xmv7-r254-6q78): DNS cache poisoning in `io.netty:netty-resolver-dns`.
> * [CVE-2026-45416](GHSA-x4gw-5cx5-pgmh): excessive memory usage from SNIHandler in `io.netty:netty-handler` (high).
> * [CVE-2026-45536](GHSA-w573-9ffj-6ff9): file descriptor leak in `io.netty:netty-transport-native-epoll` and `io.netty:netty-transport-native-kqueue`.
> * [CVE-2026-45674](GHSA-676x-f7gg-47vc): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-46340](GHSA-5xrh-qmmq-w6ch): memory exhaustion in `io.netty:netty-transport-sctp` (high).
> * [CVE-2026-47244](GHSA-5x3r-wrvg-rp6q): denial of service in `io.netty:netty-codec-http2`.
> * [CVE-2026-48006](GHSA-6jv9-x5w9-2ccm): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-48748](GHSA-4grm-h2qv-h6w6): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-48043](GHSA-c2gf-v879-257j): memory exhaustion in `io.netty:netty-codec-http2`.
>
> What's Changed
> --------------
>
> * Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16836](https://redirect.github.com/netty/netty/pull/16836)
> * HTTP/2: Parse request-target path like Vert.x by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16810](https://redirect.github.com/netty/netty/pull/16810)
> * Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16853](https://redirect.github.com/netty/netty/pull/16853)
> * FlowControlHandler: Suppress duplicate channelReadComplete after draining queue ([#15053](https://redirect.github.com/netty/netty/issues/15053)) by [`@​schiemon`](https://github.com/schiemon) in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * Pass maxAllocation to Brotli and Zstd decoders by [`@​fedinskiy`](https://github.com/fedinskiy) in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
> * Fix revapi warnings by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16885](https://redirect.github.com/netty/netty/pull/16885)
> * Fix SCTP and Redis tests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16893](https://redirect.github.com/netty/netty/pull/16893)
> * Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by [`@​skyguard1`](https://github.com/skyguard1) in [netty/netty#16850](https://redirect.github.com/netty/netty/pull/16850)
> * Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16890](https://redirect.github.com/netty/netty/pull/16890)
>
> New Contributors
> ----------------
>
> * [`@​schiemon`](https://github.com/schiemon) made their first contribution in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * [`@​fedinskiy`](https://github.com/fedinskiy) made their first contribution in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
>
> **Full Changelog**: <netty/netty@netty-4.2.14.Final...netty-4.2.15.Final>


Commits

* [`a41f7b2`](netty/netty@a41f7b2) [maven-release-plugin] prepare release netty-4.2.15.Final
* [`2394530`](netty/netty@2394530) Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
* [`0bd1657`](netty/netty@0bd1657) Add maxWindowLog parameter to ZstdDecoder to bound memory allocation ([#16850](https://redirect.github.com/netty/netty/issues/16850))
* [`76291f5`](netty/netty@76291f5) Fix SCTP and Redis tests ([#16893](https://redirect.github.com/netty/netty/issues/16893))
* [`e067b6e`](netty/netty@e067b6e) Fix revapi warnings ([#16885](https://redirect.github.com/netty/netty/issues/16885))
* [`5a52600`](netty/netty@5a52600) Pass maxAllocation to Brotli and Zstd decoders ([#16844](https://redirect.github.com/netty/netty/issues/16844))
* [`541add0`](netty/netty@541add0) Merge commit from fork
* [`270800e`](netty/netty@270800e) Merge commit from fork
* [`3d45a1e`](netty/netty@3d45a1e) Merge commit from fork
* [`75127ca`](netty/netty@75127ca) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.14.Final...netty-4.2.15.Final)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…l [skip ci]

Bumps [io.netty:netty-all](https://github.com/netty/netty) from 4.2.14.Final to 4.2.15.Final.
Release notes

*Sourced from [io.netty:netty-all's releases](https://github.com/netty/netty/releases).*

> netty-4.2.15.Final
> ------------------
>
> Security fixes
> --------------
>
> * [CVE-2026-48059](GHSA-h2qv-fj59-j46j): memory exhaustion in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-47691](GHSA-5pvg-856g-cp85): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-XXXXX](https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm): DDoS in `io.netty:netty-codec-http2`.
> * [CVE-2026-50011](GHSA-5w86-c3rq-vjj7): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44250](GHSA-3244-j874-rhc2): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-44890](GHSA-6ghj-frrj-jjj3): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-50009](GHSA-cq4q-cv5g-r8q5): information disclosure and denial of service in `io.netty:netty-codec-classes-quic`.
> * [CVE-2026-44249](GHSA-3qp7-7mw8-wx86): IPv6 subnet filter bypass in `io.netty:netty-handler` (high).
> * [CVE-2026-50020](GHSA-hvcg-qmg6-jm4c): request smuggling in `io.netty:netty-codec-http`.
> * [CVE-2026-44892](GHSA-c2rx-5r8w-8xr2): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-44893](GHSA-cc37-9q2j-3hfv): memory leak in `io.netty:netty-codec-haproxy` (high).
> * [CVE-2026-44894](GHSA-cmm3-54f8-px4j): traffic amplification in `io.netty:netty-codec-classes-quic` (high).
> * [CVE-2026-50010](GHSA-c653-97m9-rcg9): TLS hostname verification accidentally disabled in `io.netty:netty-handler` (high).
> * [CVE-2026-45673](GHSA-xmv7-r254-6q78): DNS cache poisoning in `io.netty:netty-resolver-dns`.
> * [CVE-2026-45416](GHSA-x4gw-5cx5-pgmh): excessive memory usage from SNIHandler in `io.netty:netty-handler` (high).
> * [CVE-2026-45536](GHSA-w573-9ffj-6ff9): file descriptor leak in `io.netty:netty-transport-native-epoll` and `io.netty:netty-transport-native-kqueue`.
> * [CVE-2026-45674](GHSA-676x-f7gg-47vc): DNS cache poisoning in `io.netty:netty-resolver-dns` (high).
> * [CVE-2026-46340](GHSA-5xrh-qmmq-w6ch): memory exhaustion in `io.netty:netty-transport-sctp` (high).
> * [CVE-2026-47244](GHSA-5x3r-wrvg-rp6q): denial of service in `io.netty:netty-codec-http2`.
> * [CVE-2026-48006](GHSA-6jv9-x5w9-2ccm): memory exhaustion in `io.netty:netty-codec-redis` (high).
> * [CVE-2026-48748](GHSA-4grm-h2qv-h6w6): memory exhaustion in `io.netty:netty-codec-http3` (high).
> * [CVE-2026-48043](GHSA-c2gf-v879-257j): memory exhaustion in `io.netty:netty-codec-http2`.
>
> What's Changed
> --------------
>
> * Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by [`@​dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16836](https://redirect.github.com/netty/netty/pull/16836)
> * HTTP/2: Parse request-target path like Vert.x by [`@​yawkat`](https://github.com/yawkat) in [netty/netty#16810](https://redirect.github.com/netty/netty/pull/16810)
> * Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16853](https://redirect.github.com/netty/netty/pull/16853)
> * FlowControlHandler: Suppress duplicate channelReadComplete after draining queue ([#15053](https://redirect.github.com/netty/netty/issues/15053)) by [`@​schiemon`](https://github.com/schiemon) in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * Pass maxAllocation to Brotli and Zstd decoders by [`@​fedinskiy`](https://github.com/fedinskiy) in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
> * Fix revapi warnings by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16885](https://redirect.github.com/netty/netty/pull/16885)
> * Fix SCTP and Redis tests by [`@​chrisvest`](https://github.com/chrisvest) in [netty/netty#16893](https://redirect.github.com/netty/netty/pull/16893)
> * Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by [`@​skyguard1`](https://github.com/skyguard1) in [netty/netty#16850](https://redirect.github.com/netty/netty/pull/16850)
> * Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by [`@​netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16890](https://redirect.github.com/netty/netty/pull/16890)
>
> New Contributors
> ----------------
>
> * [`@​schiemon`](https://github.com/schiemon) made their first contribution in [netty/netty#16837](https://redirect.github.com/netty/netty/pull/16837)
> * [`@​fedinskiy`](https://github.com/fedinskiy) made their first contribution in [netty/netty#16844](https://redirect.github.com/netty/netty/pull/16844)
>
> **Full Changelog**: <netty/netty@netty-4.2.14.Final...netty-4.2.15.Final>


Commits

* [`a41f7b2`](netty/netty@a41f7b2) [maven-release-plugin] prepare release netty-4.2.15.Final
* [`2394530`](netty/netty@2394530) Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
* [`0bd1657`](netty/netty@0bd1657) Add maxWindowLog parameter to ZstdDecoder to bound memory allocation ([#16850](https://redirect.github.com/netty/netty/issues/16850))
* [`76291f5`](netty/netty@76291f5) Fix SCTP and Redis tests ([#16893](https://redirect.github.com/netty/netty/issues/16893))
* [`e067b6e`](netty/netty@e067b6e) Fix revapi warnings ([#16885](https://redirect.github.com/netty/netty/issues/16885))
* [`5a52600`](netty/netty@5a52600) Pass maxAllocation to Brotli and Zstd decoders ([#16844](https://redirect.github.com/netty/netty/issues/16844))
* [`541add0`](netty/netty@541add0) Merge commit from fork
* [`270800e`](netty/netty@270800e) Merge commit from fork
* [`3d45a1e`](netty/netty@3d45a1e) Merge commit from fork
* [`75127ca`](netty/netty@75127ca) Merge commit from fork
* Additional commits viewable in [compare view](netty/netty@netty-4.2.14.Final...netty-4.2.15.Final)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=io.netty:netty-all&package-manager=maven&previous-version=4.2.14.Final&new-version=4.2.15.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)