Reject control characters at the boundary of HTTP method names by daguimu · Pull Request #16723 · netty/netty

daguimu · 2026-04-29T03:21:34Z

Problem

HttpMethod's constructor accepts a wire-level method name such as \x00GET\x00 and silently treats it as GET. Because the method name is later compared against expected values (HttpMethod.GET, etc.), this masks the difference between a clean GET and a control-byte-padded one — a known HTTP request-smuggling vector when Netty sits behind a proxy or in front of a backend that interprets the bytes differently.

A reproducer is in #15047:

printf '\x00GET\x00 / HTTP/1.1\r\n\r\n' | nc localhost 80
# → request is decoded as method=GET, isSuccess=true

Root Cause

HttpMethod(String) runs checkNonEmptyAfterTrim(name, …) before validating the name as an HTTP token. String.trim() strips every character with code point ≤ 0x20, which includes NUL, CR, LF, VT, FF, and the rest of the C0 range. After the trim the surviving string is a clean "GET", which passes HttpHeaderValidationUtil.validateToken even though the wire bytes contained a non-token character at the boundary.

Fix

In codec-http/src/main/java/io/netty/handler/codec/http/HttpMethod.java:

Replace the String.trim()-based pre-pass with an explicit loop that only skips the single space (0x20) and horizontal tab (0x09) characters at the start and end.
Throw IllegalArgumentException("name cannot be empty") if the result is empty.
Run the existing HttpHeaderValidationUtil.validateToken facade against the resulting substring, so any non-token character — including a NUL left at the boundary — is reported via "Illegal character in HTTP Method: 0x…".

The HTTP request decoder already wraps createMessage exceptions into a decoder failure on the resulting HttpRequest, so the upstream effect is that \x00GET\x00 … produces an HttpRequest with decoderResult().isSuccess() == false instead of a phantom GET.

Tests Added

New codec-http/src/test/java/io/netty/handler/codec/http/HttpMethodTest.java (17 tests). NUL bytes are constructed via String.valueOf((char) 0x00) so the source file stays text-only.

Change point	Test
Cached lookup of standard methods unchanged	`valueOfReturnsCachedInstanceForKnownMethods`
Custom method names still accepted	`constructorAcceptsCustomMethodName`
`SP` trim still works (regression)	`constructorTrimsLeadingAndTrailingSpaces`
`HT` trim still works (regression)	`constructorTrimsLeadingAndTrailingTabs`
Reject NUL at start/end/both/embedded	`constructorRejectsLeadingNul`, `constructorRejectsTrailingNul`, `constructorRejectsLeadingAndTrailingNul`, `constructorRejectsEmbeddedNul`
Reject other C0 control chars previously stripped by `trim()`	`constructorRejectsCarriageReturn`, `constructorRejectsLineFeed`, `constructorRejectsVerticalTab`, `constructorRejectsFormFeed`
Reject embedded space (still a non-token char per RFC 7230)	`constructorRejectsEmbeddedSpace`
Reject empty / blank-only names	`constructorRejectsEmptyString`, `constructorRejectsBlankString`
End-to-end: decoder fails on NUL-padded method	`requestDecoderRejectsNulPaddedMethod`
End-to-end regression: clean `GET` still parses	`requestDecoderAcceptsCleanMethod`

mvn -pl codec-http test runs 7834 tests with 0 failures locally.

Impact

API: HttpMethod's public constructor becomes stricter — inputs containing characters that were previously silently stripped (anything below 0x20 other than SP and HT) now throw IllegalArgumentException. Method names that already conform to RFC 7230's token rule are unaffected, and lenient SP/HT padding is still tolerated for backward compatibility.
Wire effect: A request whose method on the wire contains NUL, CR, LF, VT, FF, or other control bytes now produces a failed HttpRequest (decoderResult().isSuccess() == false) instead of being silently normalised — the existing HttpRequestDecoder failure plumbing handles the rest.
No changes outside HttpMethod and the new test class.

Fixes #15047

franz1981 · 2026-05-05T09:14:15Z

@@ -118,13 +118,33 @@ public static HttpMethod valueOf(String name) {
     * <a href="https://en.wikipedia.org/wiki/Internet_Content_Adaptation_Protocol">ICAP</a>
     */
    public HttpMethod(String name) {


we probably don't want, for known and trusty method names, to perform this validation - as it is going to be paid i the hot path ^^

how this is found really? under which cases?

Thanks for the review!

On how this was found — reported in #15047 with this reproducer:

printf '\x00GET\x00 / HTTP/1.1\r\n\r\n' | nc <host> <port> # → method=GET, decoderResult().isSuccess() == true

The risk is request smuggling: when Netty sits behind a proxy or in front of a backend that interprets the wire bytes differently than String.trim() does, the two ends disagree about what the method actually was. Everything String.trim() silently strips (NUL/CR/LF/VT/FF and the rest of C0) survives on the wire but vanishes in the parsed HttpMethod.

On hot-path cost — I think this is cheaper than it looks once you trace the call chain:

The decoder calls HttpMethod.valueOf(...) at HttpRequestDecoder.java:222, not new HttpMethod(...).

valueOf is a switch over the 9 standard methods that returns the cached singleton — the constructor never runs on the standard-method hot path, so neither old nor new validation executes there.

Only non-standard methods (PROPFIND, MKCOL, RTSP DESCRIBE, ICAP REQMOD, …) fall through to new HttpMethod(name).

For those, HttpUtil.validateToken(name) was already running pre-PR — this change doesn't add a validation pass.

The only delta is the prefix step: checkNonEmptyAfterTrim (which calls String.trim(), always scans, and allocates a new String when any char ≤ 0x20 is trimmed) → two while loops over SP/HT, with start == 0 && end == name.length() short-circuiting the substring allocation when there's no padding. For a clean custom method this is, if anything, a small win.

If you'd still prefer a hard "zero validation for the trusted set" guarantee, happy to add a package-private HttpMethod(String, boolean validate) overload used by the well-known statics. Can also back the perf claim with a JMH micro if useful.

The HttpMethod constructor used String.trim() before validating the name against the HTTP token grammar. String.trim() silently strips any character with code point <= 0x20, which includes NUL, CR, LF, VT, FF and other control bytes. As a result, a wire-level method like \x00GET\x00 was accepted and recognised as GET instead of being rejected, masking a known request-smuggling vector when the parsed method is later compared against expected values. Replace the trim with a strict iterator that only skips space and horizontal tab. Anything else falls into the existing token validation and is rejected with IllegalArgumentException, which the request decoder converts into a decoder failure on the resulting HttpRequest. Fixes netty#15047

The built-in constants (GET, POST, OPTIONS, ...) are compiler-controlled literals that are known-good HTTP tokens. Wire them through a new private HttpMethod(AsciiString) constructor that skips trim+validate, so the one-time static initialisation incurs zero validation overhead. The public HttpMethod(String) constructor is unchanged and continues to validate every user-supplied or wire-derived method name.

daguimu · 2026-05-11T09:09:55Z

Thanks for the feedback @franz1981!

I've pushed an update that introduces a private HttpMethod(AsciiString) constructor used exclusively by the built-in constants (OPTIONS, GET, HEAD, POST, …). Those constants are compiler-controlled literals that are already known-good tokens, so no trimming or validation is needed for them.

The public HttpMethod(String) constructor is unchanged and still validates every user-supplied or wire-derived name, which is the path that matters for security.

To clarify the hot-path picture:

Decoding a known method (GET, POST …): HttpMethod.valueOf("GET") hits the switch and returns the cached constant — the constructor is never called.
Decoding an unknown / extension method: valueOf falls through to new HttpMethod(name), which trims and validates. This path is intentionally guarded.
Static initialisation: the nine built-in constants are now created via the private AsciiString constructor — zero trimming, zero token-scan overhead.

franz1981 · 2026-05-11T09:13:32Z

+        this.name = AsciiString.cached(trimmed);
+    }
+
+    private static boolean isSpaceOrHorizontalTab(char c) {


don't we already validate something in the HTTP encoders/decoders which could be reused here? I am not very happy we have tons of different ways to validate the same things 🙏

Updated this to call HttpHeaderValidationUtil.validateToken(...) from HttpMethod.

That keeps method-name validation behind the existing HTTP token-validation facade. The facade already documents request methods as one of the HTTP components that use token grammar, and delegates to the shared HttpUtil.validateToken(...) implementation.

I also wrapped the new EmbeddedChannel decoder tests in try/finally so the channel is always cleaned up.

chrisvest · 2026-06-09T00:48:40Z

Do we even want/need the trim behavior? I'm inclined to think that the strings passed should be valid to begin with, so we could just call validateToken and then check that the string isn't empty.

Motivation: Per review feedback, the HttpMethod(String) constructor should not trim its argument. The name is expected to already be a valid HTTP token, and stripping leading/trailing whitespace only masks malformed input. Modification: Replace the leading/trailing SP/HT stripping loop with a plain non-empty check followed by HttpHeaderValidationUtil.validateToken(). SP and HT are not token characters, so validateToken rejects them too, and control bytes such as NUL/CR/LF stay rejected as before. Built-in constants keep using the private HttpMethod(AsciiString) constructor and pay no validation cost. Tests that asserted trimming now assert rejection, plus an empty-name test. Result: Simpler constructor, no silent trimming, control-byte method names still rejected.

daguimu · 2026-06-09T03:16:07Z

Agreed — dropping the trim makes this simpler and is safe. Pushed an update: the constructor now does a non-empty check + HttpHeaderValidationUtil.validateToken(...) with no character stripping at all.

I checked the call sites before removing it: the decoder path (HttpRequestDecoder → valueOf(initialLine[0])), RtspMethods, and the HTTP/2·3 HttpConversionUtil conversions all pass method names that are already split on SP or come from compile-time literals, so none relied on trimming. Ran the full codec-http suite (~8.9k tests) plus the http2 conversion tests — all green. The only behavior change is that new HttpMethod(" GET ") now throws instead of silently returning GET, which matches your point that the input should already be a valid token.

Empty string is kept as an explicit check, since validateToken("") reports no illegal character. Built-in constants still go through the private HttpMethod(AsciiString) constructor, so the hot path pays no validation cost (addressing @franz1981's earlier concern).

Shorten the HttpMethod(String) constructor comment to state the intended behavior (non-empty, token characters only) without describing the historical trim behavior, and reference RFC 9112 instead of RFC 7230 in the decoder test comment.

chrisvest · 2026-06-09T17:18:39Z

Thanks

netty-project-bot · 2026-06-09T17:18:55Z

Auto-port PR for 5.0: #16926

…od names (#16926) Auto-port of #16723 to 5.0 Cherry-picked commit: 6ad888e --- ## Problem `HttpMethod`'s constructor accepts a wire-level method name such as `\x00GET\x00` and silently treats it as `GET`. Because the method name is later compared against expected values (`HttpMethod.GET`, etc.), this masks the difference between a clean `GET` and a control-byte-padded one — a known HTTP request-smuggling vector when Netty sits behind a proxy or in front of a backend that interprets the bytes differently. A reproducer is in #15047: ``` printf '\x00GET\x00 / HTTP/1.1\r\n\r\n' | nc localhost 80 # → request is decoded as method=GET, isSuccess=true ``` ## Root Cause `HttpMethod(String)` runs `checkNonEmptyAfterTrim(name, …)` before validating the name as an HTTP token. `String.trim()` strips every character with code point ≤ 0x20, which includes `NUL`, `CR`, `LF`, `VT`, `FF`, and the rest of the C0 range. After the trim the surviving string is a clean `"GET"`, which passes `HttpHeaderValidationUtil.validateToken` even though the wire bytes contained a non-token character at the boundary. ## Fix In `codec-http/src/main/java/io/netty/handler/codec/http/HttpMethod.java`: - Replace the `String.trim()`-based pre-pass with an explicit loop that only skips the single space (`0x20`) and horizontal tab (`0x09`) characters at the start and end. - Throw `IllegalArgumentException("name cannot be empty")` if the result is empty. - Run the existing `HttpHeaderValidationUtil.validateToken` facade against the resulting substring, so any non-token character — including a `NUL` left at the boundary — is reported via `"Illegal character in HTTP Method: 0x…"`. The HTTP request decoder already wraps `createMessage` exceptions into a decoder failure on the resulting `HttpRequest`, so the upstream effect is that `\x00GET\x00 …` produces an `HttpRequest` with `decoderResult().isSuccess() == false` instead of a phantom `GET`. ## Tests Added New `codec-http/src/test/java/io/netty/handler/codec/http/HttpMethodTest.java` (17 tests). NUL bytes are constructed via `String.valueOf((char) 0x00)` so the source file stays text-only. | Change point | Test | |--------------|------| | Cached lookup of standard methods unchanged | `valueOfReturnsCachedInstanceForKnownMethods` | | Custom method names still accepted | `constructorAcceptsCustomMethodName` | | `SP` trim still works (regression) | `constructorTrimsLeadingAndTrailingSpaces` | | `HT` trim still works (regression) | `constructorTrimsLeadingAndTrailingTabs` | | Reject NUL at start/end/both/embedded | `constructorRejectsLeadingNul`, `constructorRejectsTrailingNul`, `constructorRejectsLeadingAndTrailingNul`, `constructorRejectsEmbeddedNul` | | Reject other C0 control chars previously stripped by `trim()` | `constructorRejectsCarriageReturn`, `constructorRejectsLineFeed`, `constructorRejectsVerticalTab`, `constructorRejectsFormFeed` | | Reject embedded space (still a non-token char per RFC 7230) | `constructorRejectsEmbeddedSpace` | | Reject empty / blank-only names | `constructorRejectsEmptyString`, `constructorRejectsBlankString` | | End-to-end: decoder fails on NUL-padded method | `requestDecoderRejectsNulPaddedMethod` | | End-to-end regression: clean `GET` still parses | `requestDecoderAcceptsCleanMethod` | `mvn -pl codec-http test` runs 7834 tests with 0 failures locally. ## Impact - API: `HttpMethod`'s public constructor becomes stricter — inputs containing characters that were previously silently stripped (anything below `0x20` other than `SP` and `HT`) now throw `IllegalArgumentException`. Method names that already conform to RFC 7230's `token` rule are unaffected, and lenient `SP`/`HT` padding is still tolerated for backward compatibility. - Wire effect: A request whose method on the wire contains `NUL`, `CR`, `LF`, `VT`, `FF`, or other control bytes now produces a failed `HttpRequest` (`decoderResult().isSuccess() == false`) instead of being silently normalised — the existing `HttpRequestDecoder` failure plumbing handles the rest. - No changes outside `HttpMethod` and the new test class. Fixes #15047 --------- Co-authored-by: Guimu <[email protected]> Co-authored-by: Chris Vest <[email protected]>

normanmaurer · 2026-06-10T07:03:22Z

@chrisvest shouldn't we also port this to 4.1 ?

netty-project-bot · 2026-06-10T16:24:13Z

Could not create auto-port PR.
Got conflicts when cherry-picking onto 4.1.

chrisvest · 2026-06-10T22:11:38Z

4.1 port: #16933

… (#16933) ## Problem `HttpMethod`'s constructor accepts a wire-level method name such as `\x00GET\x00` and silently treats it as `GET`. Because the method name is later compared against expected values (`HttpMethod.GET`, etc.), this masks the difference between a clean `GET` and a control-byte-padded one — a known HTTP request-smuggling vector when Netty sits behind a proxy or in front of a backend that interprets the bytes differently. A reproducer is in #15047: ``` printf '\x00GET\x00 / HTTP/1.1\r\n\r\n' | nc localhost 80 # → request is decoded as method=GET, isSuccess=true ``` ## Root Cause `HttpMethod(String)` runs `checkNonEmptyAfterTrim(name, …)` before validating the name as an HTTP token. `String.trim()` strips every character with code point ≤ 0x20, which includes `NUL`, `CR`, `LF`, `VT`, `FF`, and the rest of the C0 range. After the trim the surviving string is a clean `"GET"`, which passes `HttpHeaderValidationUtil.validateToken` even though the wire bytes contained a non-token character at the boundary. ## Fix In `codec-http/src/main/java/io/netty/handler/codec/http/HttpMethod.java`: - Replace the `String.trim()`-based pre-pass with an explicit loop that only skips the single space (`0x20`) and horizontal tab (`0x09`) characters at the start and end. - Throw `IllegalArgumentException("name cannot be empty")` if the result is empty. - Run the existing `HttpHeaderValidationUtil.validateToken` facade against the resulting substring, so any non-token character — including a `NUL` left at the boundary — is reported via `"Illegal character in HTTP Method: 0x…"`. The HTTP request decoder already wraps `createMessage` exceptions into a decoder failure on the resulting `HttpRequest`, so the upstream effect is that `\x00GET\x00 …` produces an `HttpRequest` with `decoderResult().isSuccess() == false` instead of a phantom `GET`. ## Tests Added New `codec-http/src/test/java/io/netty/handler/codec/http/HttpMethodTest.java` (17 tests). NUL bytes are constructed via `String.valueOf((char) 0x00)` so the source file stays text-only. | Change point | Test | |--------------|------| | Cached lookup of standard methods unchanged | `valueOfReturnsCachedInstanceForKnownMethods` | | Custom method names still accepted | `constructorAcceptsCustomMethodName` | | `SP` trim still works (regression) | `constructorTrimsLeadingAndTrailingSpaces` | | `HT` trim still works (regression) | `constructorTrimsLeadingAndTrailingTabs` | | Reject NUL at start/end/both/embedded | `constructorRejectsLeadingNul`, `constructorRejectsTrailingNul`, `constructorRejectsLeadingAndTrailingNul`, `constructorRejectsEmbeddedNul` | | Reject other C0 control chars previously stripped by `trim()` | `constructorRejectsCarriageReturn`, `constructorRejectsLineFeed`, `constructorRejectsVerticalTab`, `constructorRejectsFormFeed` | | Reject embedded space (still a non-token char per RFC 7230) | `constructorRejectsEmbeddedSpace` | | Reject empty / blank-only names | `constructorRejectsEmptyString`, `constructorRejectsBlankString` | | End-to-end: decoder fails on NUL-padded method | `requestDecoderRejectsNulPaddedMethod` | | End-to-end regression: clean `GET` still parses | `requestDecoderAcceptsCleanMethod` | `mvn -pl codec-http test` runs 7834 tests with 0 failures locally. ## Impact - API: `HttpMethod`'s public constructor becomes stricter — inputs containing characters that were previously silently stripped (anything below `0x20` other than `SP` and `HT`) now throw `IllegalArgumentException`. Method names that already conform to RFC 7230's `token` rule are unaffected, and lenient `SP`/`HT` padding is still tolerated for backward compatibility. - Wire effect: A request whose method on the wire contains `NUL`, `CR`, `LF`, `VT`, `FF`, or other control bytes now produces a failed `HttpRequest` (`decoderResult().isSuccess() == false`) instead of being silently normalised — the existing `HttpRequestDecoder` failure plumbing handles the rest. - No changes outside `HttpMethod` and the new test class. Fixes #15047 (cherry picked from commit 6ad888e) --------- Co-authored-by: Guimu <[email protected]>

…16971) Motivation: `HttpRequestDecoder` accepts a request whose HTTP-version token carries a boundary control byte (`NUL`, `CR`, `LF`, `VT`, `FF`, …): ```bash printf 'GET / \x00HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc <host> <port> # decoded as a clean HTTP/1.1 request; no decoder failure ``` `HttpVersion.valueOf(String, boolean)` ran `text.trim()` before matching the version, and `String.trim()` removes every character with code point `<= 0x20`. The boundary control byte was therefore silently stripped and the surviving `"HTTP/1.1"` matched the cached constant, so the malformed request decoded as a clean `HTTP/1.1` one. The method token on the same request line already rejects such a byte since #16723 (issue #15047), so the two tokens were inconsistent — this is the same boundary-control-character / request-smuggling class, left open for the version token. Modification: - `HttpVersion`: drop the `trim()` in `valueOf` and in the `HttpVersion(String, boolean, boolean)` constructor. The existing strict format check (`length == 8 && startsWith("HTTP/") && charAt(6) == '.'`) now rejects a token padded with a control byte, and the non-strict path rejects control/whitespace in the protocol name via `hasControlOrWhitespace`. Without the `trim()`, `SP`/`HT` padding is rejected too, mirroring the method-token behaviour from #16723. - `RtspVersions.valueOf`: drop the `trim()` the same way. `HttpRequestDecoder` already turns `createMessage` exceptions into a decoder failure, so the wire effect is `decoderResult().isSuccess() == false` instead of a phantom `HTTP/1.1`. Result: Before this change `"GET / \x00HTTP/1.1\r\n…"` decoded successfully (`decoderResult().isSuccess() == true`, `protocolVersion() == HTTP_1_1`); after it the decoder reports a failure, matching the method-token behaviour. A clean `HTTP/1.1` request still decodes as before. ``` Test set: io.netty.handler.codec.http.HttpVersionParsingTest Tests run: 53, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.http.HttpRequestDecoderTest Tests run: 85, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.rtsp.RtspDecoderTest Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.rtsp.RtspEncoderTest Tests run: 4, Failures: 0, Errors: 0, Skipped: 0 ``` Fixes #16970 --------- Co-authored-by: Bryce Anderson <[email protected]>

…version token (#16981) Auto-port of #16971 to 5.0 Cherry-picked commit: 69b7851 --- Motivation: `HttpRequestDecoder` accepts a request whose HTTP-version token carries a boundary control byte (`NUL`, `CR`, `LF`, `VT`, `FF`, …): ```bash printf 'GET / \x00HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc <host> <port> # decoded as a clean HTTP/1.1 request; no decoder failure ``` `HttpVersion.valueOf(String, boolean)` ran `text.trim()` before matching the version, and `String.trim()` removes every character with code point `<= 0x20`. The boundary control byte was therefore silently stripped and the surviving `"HTTP/1.1"` matched the cached constant, so the malformed request decoded as a clean `HTTP/1.1` one. The method token on the same request line already rejects such a byte since #16723 (issue #15047), so the two tokens were inconsistent — this is the same boundary-control-character / request-smuggling class, left open for the version token. Modification: - `HttpVersion`: drop the `trim()` in `valueOf` and in the `HttpVersion(String, boolean, boolean)` constructor. The existing strict format check (`length == 8 && startsWith("HTTP/") && charAt(6) == '.'`) now rejects a token padded with a control byte, and the non-strict path rejects control/whitespace in the protocol name via `hasControlOrWhitespace`. Without the `trim()`, `SP`/`HT` padding is rejected too, mirroring the method-token behaviour from #16723. - `RtspVersions.valueOf`: drop the `trim()` the same way. `HttpRequestDecoder` already turns `createMessage` exceptions into a decoder failure, so the wire effect is `decoderResult().isSuccess() == false` instead of a phantom `HTTP/1.1`. Result: Before this change `"GET / \x00HTTP/1.1\r\n…"` decoded successfully (`decoderResult().isSuccess() == true`, `protocolVersion() == HTTP_1_1`); after it the decoder reports a failure, matching the method-token behaviour. A clean `HTTP/1.1` request still decodes as before. ``` Test set: io.netty.handler.codec.http.HttpVersionParsingTest Tests run: 53, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.http.HttpRequestDecoderTest Tests run: 85, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.rtsp.RtspDecoderTest Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.rtsp.RtspEncoderTest Tests run: 4, Failures: 0, Errors: 0, Skipped: 0 ``` Fixes #16970 --------- Co-authored-by: HwangRock <[email protected]> Co-authored-by: Bryce Anderson <[email protected]> Co-authored-by: Chris Vest <[email protected]>

…16971) (#16986) Motivation: `HttpRequestDecoder` accepts a request whose HTTP-version token carries a boundary control byte (`NUL`, `CR`, `LF`, `VT`, `FF`, …): ```bash printf 'GET / \x00HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc <host> <port> ``` `HttpVersion.valueOf(String, boolean)` ran `text.trim()` before matching the version, and `String.trim()` removes every character with code point `<= 0x20`. The boundary control byte was therefore silently stripped and the surviving `"HTTP/1.1"` matched the cached constant, so the malformed request decoded as a clean `HTTP/1.1` one. The method token on the same request line already rejects such a byte since #16723 (issue #15047), so the two tokens were inconsistent — this is the same boundary-control-character / request-smuggling class, left open for the version token. Modification: - `HttpVersion`: drop the `trim()` in `valueOf` and in the `HttpVersion(String, boolean, boolean)` constructor. The existing strict format check (`length == 8 && startsWith("HTTP/") && charAt(6) == '.'`) now rejects a token padded with a control byte, and the non-strict path rejects control/whitespace in the protocol name via `hasControlOrWhitespace`. Without the `trim()`, `SP`/`HT` padding is rejected too, mirroring the method-token behaviour from #16723. - `RtspVersions.valueOf`: drop the `trim()` the same way. `HttpRequestDecoder` already turns `createMessage` exceptions into a decoder failure, so the wire effect is `decoderResult().isSuccess() == false` instead of a phantom `HTTP/1.1`. Result: Before this change `"GET / \x00HTTP/1.1\r\n…"` decoded successfully (`decoderResult().isSuccess() == true`, `protocolVersion() == HTTP_1_1`); after it the decoder reports a failure, matching the method-token behaviour. A clean `HTTP/1.1` request still decodes as before. ``` Test set: io.netty.handler.codec.http.HttpVersionParsingTest Tests run: 53, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.http.HttpRequestDecoderTest Tests run: 85, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.rtsp.RtspDecoderTest Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 Test set: io.netty.handler.codec.rtsp.RtspEncoderTest Tests run: 4, Failures: 0, Errors: 0, Skipped: 0 ``` Fixes #16970 --------- Co-authored-by: Bryce Anderson <[email protected]> --------- Co-authored-by: HwangRock <[email protected]> Co-authored-by: Bryce Anderson <[email protected]>

…l [skip ci] Bumps [io.netty:netty-all](https://github.com/netty/netty) from 4.2.15.Final to 4.2.16.Final. Release notes *Sourced from [io.netty:netty-all's releases](https://github.com/netty/netty/releases).* > netty-4.2.16.Final > ------------------ > > What's Changed > -------------- > > * Document Java 9 requirement for io\_uring by [`@jchambers`](https://github.com/jchambers) in [netty/netty#16904](https://redirect.github.com/netty/netty/pull/16904) > * Add BlockHound exception for DnsQueryIdSpace by [`@violetagg`](https://github.com/violetagg) in [netty/netty#16896](https://redirect.github.com/netty/netty/pull/16896) > * Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16901](https://redirect.github.com/netty/netty/pull/16901) > * Add epoch-based chunk cache purge with ring buffer for thread-local reuse by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16766](https://redirect.github.com/netty/netty/pull/16766) > * Use Splittable/ThreadLocalRandom to generate bulk data in tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16808](https://redirect.github.com/netty/netty/pull/16808) > * Auto-port 4.2: SingleThreadEventExecutor: document Throwable safety contract on run() by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16909](https://redirect.github.com/netty/netty/pull/16909) > * Auto-port 4.2: Make HTTP/2 frame hashCode consistent with equals by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16910](https://redirect.github.com/netty/netty/pull/16910) > * Auto-port 4.2: MQTT: Make the decodeProperties early-REPLAY check actually fire by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16919](https://redirect.github.com/netty/netty/pull/16919) > * IoUring: fix io\_uring datagram writes with non-zero readerIndex by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16905](https://redirect.github.com/netty/netty/pull/16905) > * Exclude internal events from IoHandler.run() return value in epoll, io\_uring and kqueue by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16848](https://redirect.github.com/netty/netty/pull/16848) > * IoUring: Pass IORING\_ENTER\_NO\_IOWAIT to report accurate CPU usage by [`@wineway`](https://github.com/wineway) in [netty/netty#16739](https://redirect.github.com/netty/netty/pull/16739) > * Avoid logging exceptions that tests ignore by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16891](https://redirect.github.com/netty/netty/pull/16891) > * Reject control characters at the boundary of HTTP method names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16723](https://redirect.github.com/netty/netty/pull/16723) > * IoUring: fix TCP Fast Open initial writes with readerIndex and composites by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16929](https://redirect.github.com/netty/netty/pull/16929) > * Try to fix/stabilize a number of flaky tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16934](https://redirect.github.com/netty/netty/pull/16934) > * Fix propagation of startTls for client SslContext handlers by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16931](https://redirect.github.com/netty/netty/pull/16931) > * Update to latest tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16936](https://redirect.github.com/netty/netty/pull/16936) > * Move test to shared testsuite by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16928](https://redirect.github.com/netty/netty/pull/16928) > * [Refactor] Useful helper method getOrDefault & cleaner abstraction by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#16927](https://redirect.github.com/netty/netty/pull/16927) > * Make permessage-deflate server window size and memLevel configurable by [`@fru1tworld`](https://github.com/fru1tworld) in [netty/netty#16809](https://redirect.github.com/netty/netty/pull/16809) > * Return early in DnsQueryContext.writeQuery when the query ID space is exhausted by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16950](https://redirect.github.com/netty/netty/pull/16950) > * Fix HTTP 2 PUSH\_PROMISE stream association validation by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16952](https://redirect.github.com/netty/netty/pull/16952) > * Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16951](https://redirect.github.com/netty/netty/pull/16951) > * Http3FrameCodec handle fragmented payloads when skipping unknown frames by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16960](https://redirect.github.com/netty/netty/pull/16960) > * Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by [`@hyperxpro`](https://github.com/hyperxpro) in [netty/netty#16932](https://redirect.github.com/netty/netty/pull/16932) > * Strictly validate MQTT UTF-8 Encoded String by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16939](https://redirect.github.com/netty/netty/pull/16939) > * Stop DateFormatter trailing token from running past the parse end by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16958](https://redirect.github.com/netty/netty/pull/16958) > * IpFilter: Deprecate constructor which use accept by default by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16961](https://redirect.github.com/netty/netty/pull/16961) > * Add RFC 10008 QUERY Method support by [`@desiderantes`](https://github.com/desiderantes) in [netty/netty#16966](https://redirect.github.com/netty/netty/pull/16966) > * Correctly release and fail queued traffic-shaping writes on close by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16959](https://redirect.github.com/netty/netty/pull/16959) > * Reject control characters at the boundary of the HTTP version token by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16971](https://redirect.github.com/netty/netty/pull/16971) > * FlowControlHandler: respect auto-read when toggled while dequeueing by [`@schiemon`](https://github.com/schiemon) in [netty/netty#16949](https://redirect.github.com/netty/netty/pull/16949) > * Fix leak in ReferenceCountedOpenSslEngine.addCredential by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16979](https://redirect.github.com/netty/netty/pull/16979) > * IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout by [`@husseinvr97`](https://github.com/husseinvr97) in [netty/netty#16982](https://redirect.github.com/netty/netty/pull/16982) > * Fix typo in AbstractSniHandler Javadoc by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#16988](https://redirect.github.com/netty/netty/pull/16988) > * Fix client/server inconsistency in SslCredential support matrix by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16990](https://redirect.github.com/netty/netty/pull/16990) > * Reconcile `AbstractCoalescingBufferQueue` readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by [`@gavinbunney`](https://github.com/gavinbunney) in [netty/netty#16947](https://redirect.github.com/netty/netty/pull/16947) > * Use Ticker in Http2MaxRstFrameListener for testability by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16993](https://redirect.github.com/netty/netty/pull/16993) > * Reset UTF-8 decode state on CR in StompSubframeDecoder by [`@vasiliy-mikhailov`](https://github.com/vasiliy-mikhailov) in [netty/netty#16991](https://redirect.github.com/netty/netty/pull/16991) > * FastLz: Guard decompression against truncated input by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17000](https://redirect.github.com/netty/netty/pull/17000) > * Reject non-token characters in HTTP/2 header names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16762](https://redirect.github.com/netty/netty/pull/16762) > * Auto-port 4.2: Fix SelfSignCertificate initialization in tests by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#17029](https://redirect.github.com/netty/netty/pull/17029) > * Enable extension of Http3ClientConnectionHandler to support higher-level protocols such as WebTransport. by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#17027](https://redirect.github.com/netty/netty/pull/17027) > * Implement Adaptive Cumulator by [`@shivaspeaks`](https://github.com/shivaspeaks) in [netty/netty#16731](https://redirect.github.com/netty/netty/pull/16731) > * Allow WebSocket extension negotiation to be disabled per response by [`@mkurz`](https://github.com/mkurz) in [netty/netty#17030](https://redirect.github.com/netty/netty/pull/17030) > * Support QPACK sensitivity detector for Never Indexed header fields by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17026](https://redirect.github.com/netty/netty/pull/17026) > * Fix maxAllocation for brotli-encoded content in HttpContentDecompressor by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17037](https://redirect.github.com/netty/netty/pull/17037) > * Pin github actions to reduce risk by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17043](https://redirect.github.com/netty/netty/pull/17043) ... (truncated) Commits * [`3703d79`](netty/netty@3703d79) [maven-release-plugin] prepare release netty-4.2.16.Final * [`63bbb2c`](netty/netty@63bbb2c) Update rust toolchain - add required parameters * [`ac06c1b`](netty/netty@ac06c1b) Update rust toolchain * [`5b68c61`](netty/netty@5b68c61) Merge branches from forks ([#17063](https://redirect.github.com/netty/netty/issues/17063)) * [`de5d276`](netty/netty@de5d276) Update lz4-java to 1.11.1 ([#17061](https://redirect.github.com/netty/netty/issues/17061)) * [`da22048`](netty/netty@da22048) Pin github actions to reduce risk ([#17043](https://redirect.github.com/netty/netty/issues/17043)) * [`0332676`](netty/netty@0332676) Fix maxAllocation for brotli-encoded content in HttpContentDecompressor ([#17037](https://redirect.github.com/netty/netty/issues/17037)) * [`7364401`](netty/netty@7364401) Support QPACK sensitivity detector for Never Indexed header fields ([#17026](https://redirect.github.com/netty/netty/issues/17026)) * [`06faf18`](netty/netty@06faf18) Allow WebSocket extension negotiation to be disabled per response ([#17030](https://redirect.github.com/netty/netty/issues/17030)) * [`bc4b983`](netty/netty@bc4b983) Implement Adaptive Cumulator ([#16731](https://redirect.github.com/netty/netty/issues/16731)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.15.Final...netty-4.2.16.Final) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=io.netty:netty-all&package-manager=maven&previous-version=4.2.15.Final&new-version=4.2.16.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…ip ci] Bumps `netty.version` from 4.2.15.Final to 4.2.16.Final. Updates `io.netty:netty-transport` from 4.2.15.Final to 4.2.16.Final Release notes *Sourced from [io.netty:netty-transport's releases](https://github.com/netty/netty/releases).* > netty-4.2.16.Final > ------------------ > > What's Changed > -------------- > > * Document Java 9 requirement for io\_uring by [`@jchambers`](https://github.com/jchambers) in [netty/netty#16904](https://redirect.github.com/netty/netty/pull/16904) > * Add BlockHound exception for DnsQueryIdSpace by [`@violetagg`](https://github.com/violetagg) in [netty/netty#16896](https://redirect.github.com/netty/netty/pull/16896) > * Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16901](https://redirect.github.com/netty/netty/pull/16901) > * Add epoch-based chunk cache purge with ring buffer for thread-local reuse by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16766](https://redirect.github.com/netty/netty/pull/16766) > * Use Splittable/ThreadLocalRandom to generate bulk data in tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16808](https://redirect.github.com/netty/netty/pull/16808) > * Auto-port 4.2: SingleThreadEventExecutor: document Throwable safety contract on run() by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16909](https://redirect.github.com/netty/netty/pull/16909) > * Auto-port 4.2: Make HTTP/2 frame hashCode consistent with equals by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16910](https://redirect.github.com/netty/netty/pull/16910) > * Auto-port 4.2: MQTT: Make the decodeProperties early-REPLAY check actually fire by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16919](https://redirect.github.com/netty/netty/pull/16919) > * IoUring: fix io\_uring datagram writes with non-zero readerIndex by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16905](https://redirect.github.com/netty/netty/pull/16905) > * Exclude internal events from IoHandler.run() return value in epoll, io\_uring and kqueue by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16848](https://redirect.github.com/netty/netty/pull/16848) > * IoUring: Pass IORING\_ENTER\_NO\_IOWAIT to report accurate CPU usage by [`@wineway`](https://github.com/wineway) in [netty/netty#16739](https://redirect.github.com/netty/netty/pull/16739) > * Avoid logging exceptions that tests ignore by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16891](https://redirect.github.com/netty/netty/pull/16891) > * Reject control characters at the boundary of HTTP method names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16723](https://redirect.github.com/netty/netty/pull/16723) > * IoUring: fix TCP Fast Open initial writes with readerIndex and composites by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16929](https://redirect.github.com/netty/netty/pull/16929) > * Try to fix/stabilize a number of flaky tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16934](https://redirect.github.com/netty/netty/pull/16934) > * Fix propagation of startTls for client SslContext handlers by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16931](https://redirect.github.com/netty/netty/pull/16931) > * Update to latest tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16936](https://redirect.github.com/netty/netty/pull/16936) > * Move test to shared testsuite by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16928](https://redirect.github.com/netty/netty/pull/16928) > * [Refactor] Useful helper method getOrDefault & cleaner abstraction by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#16927](https://redirect.github.com/netty/netty/pull/16927) > * Make permessage-deflate server window size and memLevel configurable by [`@fru1tworld`](https://github.com/fru1tworld) in [netty/netty#16809](https://redirect.github.com/netty/netty/pull/16809) > * Return early in DnsQueryContext.writeQuery when the query ID space is exhausted by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16950](https://redirect.github.com/netty/netty/pull/16950) > * Fix HTTP 2 PUSH\_PROMISE stream association validation by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16952](https://redirect.github.com/netty/netty/pull/16952) > * Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16951](https://redirect.github.com/netty/netty/pull/16951) > * Http3FrameCodec handle fragmented payloads when skipping unknown frames by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16960](https://redirect.github.com/netty/netty/pull/16960) > * Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by [`@hyperxpro`](https://github.com/hyperxpro) in [netty/netty#16932](https://redirect.github.com/netty/netty/pull/16932) > * Strictly validate MQTT UTF-8 Encoded String by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16939](https://redirect.github.com/netty/netty/pull/16939) > * Stop DateFormatter trailing token from running past the parse end by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16958](https://redirect.github.com/netty/netty/pull/16958) > * IpFilter: Deprecate constructor which use accept by default by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16961](https://redirect.github.com/netty/netty/pull/16961) > * Add RFC 10008 QUERY Method support by [`@desiderantes`](https://github.com/desiderantes) in [netty/netty#16966](https://redirect.github.com/netty/netty/pull/16966) > * Correctly release and fail queued traffic-shaping writes on close by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16959](https://redirect.github.com/netty/netty/pull/16959) > * Reject control characters at the boundary of the HTTP version token by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16971](https://redirect.github.com/netty/netty/pull/16971) > * FlowControlHandler: respect auto-read when toggled while dequeueing by [`@schiemon`](https://github.com/schiemon) in [netty/netty#16949](https://redirect.github.com/netty/netty/pull/16949) > * Fix leak in ReferenceCountedOpenSslEngine.addCredential by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16979](https://redirect.github.com/netty/netty/pull/16979) > * IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout by [`@husseinvr97`](https://github.com/husseinvr97) in [netty/netty#16982](https://redirect.github.com/netty/netty/pull/16982) > * Fix typo in AbstractSniHandler Javadoc by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#16988](https://redirect.github.com/netty/netty/pull/16988) > * Fix client/server inconsistency in SslCredential support matrix by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16990](https://redirect.github.com/netty/netty/pull/16990) > * Reconcile `AbstractCoalescingBufferQueue` readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by [`@gavinbunney`](https://github.com/gavinbunney) in [netty/netty#16947](https://redirect.github.com/netty/netty/pull/16947) > * Use Ticker in Http2MaxRstFrameListener for testability by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16993](https://redirect.github.com/netty/netty/pull/16993) > * Reset UTF-8 decode state on CR in StompSubframeDecoder by [`@vasiliy-mikhailov`](https://github.com/vasiliy-mikhailov) in [netty/netty#16991](https://redirect.github.com/netty/netty/pull/16991) > * FastLz: Guard decompression against truncated input by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17000](https://redirect.github.com/netty/netty/pull/17000) > * Reject non-token characters in HTTP/2 header names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16762](https://redirect.github.com/netty/netty/pull/16762) > * Auto-port 4.2: Fix SelfSignCertificate initialization in tests by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#17029](https://redirect.github.com/netty/netty/pull/17029) > * Enable extension of Http3ClientConnectionHandler to support higher-level protocols such as WebTransport. by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#17027](https://redirect.github.com/netty/netty/pull/17027) > * Implement Adaptive Cumulator by [`@shivaspeaks`](https://github.com/shivaspeaks) in [netty/netty#16731](https://redirect.github.com/netty/netty/pull/16731) > * Allow WebSocket extension negotiation to be disabled per response by [`@mkurz`](https://github.com/mkurz) in [netty/netty#17030](https://redirect.github.com/netty/netty/pull/17030) > * Support QPACK sensitivity detector for Never Indexed header fields by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17026](https://redirect.github.com/netty/netty/pull/17026) > * Fix maxAllocation for brotli-encoded content in HttpContentDecompressor by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17037](https://redirect.github.com/netty/netty/pull/17037) > * Pin github actions to reduce risk by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17043](https://redirect.github.com/netty/netty/pull/17043) ... (truncated) Commits * [`3703d79`](netty/netty@3703d79) [maven-release-plugin] prepare release netty-4.2.16.Final * [`63bbb2c`](netty/netty@63bbb2c) Update rust toolchain - add required parameters * [`ac06c1b`](netty/netty@ac06c1b) Update rust toolchain * [`5b68c61`](netty/netty@5b68c61) Merge branches from forks ([#17063](https://redirect.github.com/netty/netty/issues/17063)) * [`de5d276`](netty/netty@de5d276) Update lz4-java to 1.11.1 ([#17061](https://redirect.github.com/netty/netty/issues/17061)) * [`da22048`](netty/netty@da22048) Pin github actions to reduce risk ([#17043](https://redirect.github.com/netty/netty/issues/17043)) * [`0332676`](netty/netty@0332676) Fix maxAllocation for brotli-encoded content in HttpContentDecompressor ([#17037](https://redirect.github.com/netty/netty/issues/17037)) * [`7364401`](netty/netty@7364401) Support QPACK sensitivity detector for Never Indexed header fields ([#17026](https://redirect.github.com/netty/netty/issues/17026)) * [`06faf18`](netty/netty@06faf18) Allow WebSocket extension negotiation to be disabled per response ([#17030](https://redirect.github.com/netty/netty/issues/17030)) * [`bc4b983`](netty/netty@bc4b983) Implement Adaptive Cumulator ([#16731](https://redirect.github.com/netty/netty/issues/16731)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.15.Final...netty-4.2.16.Final) Updates `io.netty:netty-codec` from 4.2.15.Final to 4.2.16.Final Release notes *Sourced from [io.netty:netty-codec's releases](https://github.com/netty/netty/releases).* > netty-4.2.16.Final > ------------------ > > What's Changed > -------------- > > * Document Java 9 requirement for io\_uring by [`@jchambers`](https://github.com/jchambers) in [netty/netty#16904](https://redirect.github.com/netty/netty/pull/16904) > * Add BlockHound exception for DnsQueryIdSpace by [`@violetagg`](https://github.com/violetagg) in [netty/netty#16896](https://redirect.github.com/netty/netty/pull/16896) > * Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16901](https://redirect.github.com/netty/netty/pull/16901) > * Add epoch-based chunk cache purge with ring buffer for thread-local reuse by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16766](https://redirect.github.com/netty/netty/pull/16766) > * Use Splittable/ThreadLocalRandom to generate bulk data in tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16808](https://redirect.github.com/netty/netty/pull/16808) > * Auto-port 4.2: SingleThreadEventExecutor: document Throwable safety contract on run() by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16909](https://redirect.github.com/netty/netty/pull/16909) > * Auto-port 4.2: Make HTTP/2 frame hashCode consistent with equals by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16910](https://redirect.github.com/netty/netty/pull/16910) > * Auto-port 4.2: MQTT: Make the decodeProperties early-REPLAY check actually fire by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16919](https://redirect.github.com/netty/netty/pull/16919) > * IoUring: fix io\_uring datagram writes with non-zero readerIndex by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16905](https://redirect.github.com/netty/netty/pull/16905) > * Exclude internal events from IoHandler.run() return value in epoll, io\_uring and kqueue by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16848](https://redirect.github.com/netty/netty/pull/16848) > * IoUring: Pass IORING\_ENTER\_NO\_IOWAIT to report accurate CPU usage by [`@wineway`](https://github.com/wineway) in [netty/netty#16739](https://redirect.github.com/netty/netty/pull/16739) > * Avoid logging exceptions that tests ignore by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16891](https://redirect.github.com/netty/netty/pull/16891) > * Reject control characters at the boundary of HTTP method names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16723](https://redirect.github.com/netty/netty/pull/16723) > * IoUring: fix TCP Fast Open initial writes with readerIndex and composites by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16929](https://redirect.github.com/netty/netty/pull/16929) > * Try to fix/stabilize a number of flaky tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16934](https://redirect.github.com/netty/netty/pull/16934) > * Fix propagation of startTls for client SslContext handlers by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16931](https://redirect.github.com/netty/netty/pull/16931) > * Update to latest tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16936](https://redirect.github.com/netty/netty/pull/16936) > * Move test to shared testsuite by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16928](https://redirect.github.com/netty/netty/pull/16928) > * [Refactor] Useful helper method getOrDefault & cleaner abstraction by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#16927](https://redirect.github.com/netty/netty/pull/16927) > * Make permessage-deflate server window size and memLevel configurable by [`@fru1tworld`](https://github.com/fru1tworld) in [netty/netty#16809](https://redirect.github.com/netty/netty/pull/16809) > * Return early in DnsQueryContext.writeQuery when the query ID space is exhausted by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16950](https://redirect.github.com/netty/netty/pull/16950) > * Fix HTTP 2 PUSH\_PROMISE stream association validation by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16952](https://redirect.github.com/netty/netty/pull/16952) > * Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16951](https://redirect.github.com/netty/netty/pull/16951) > * Http3FrameCodec handle fragmented payloads when skipping unknown frames by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16960](https://redirect.github.com/netty/netty/pull/16960) > * Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by [`@hyperxpro`](https://github.com/hyperxpro) in [netty/netty#16932](https://redirect.github.com/netty/netty/pull/16932) > * Strictly validate MQTT UTF-8 Encoded String by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16939](https://redirect.github.com/netty/netty/pull/16939) > * Stop DateFormatter trailing token from running past the parse end by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16958](https://redirect.github.com/netty/netty/pull/16958) > * IpFilter: Deprecate constructor which use accept by default by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16961](https://redirect.github.com/netty/netty/pull/16961) > * Add RFC 10008 QUERY Method support by [`@desiderantes`](https://github.com/desiderantes) in [netty/netty#16966](https://redirect.github.com/netty/netty/pull/16966) > * Correctly release and fail queued traffic-shaping writes on close by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16959](https://redirect.github.com/netty/netty/pull/16959) > * Reject control characters at the boundary of the HTTP version token by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16971](https://redirect.github.com/netty/netty/pull/16971) > * FlowControlHandler: respect auto-read when toggled while dequeueing by [`@schiemon`](https://github.com/schiemon) in [netty/netty#16949](https://redirect.github.com/netty/netty/pull/16949) > * Fix leak in ReferenceCountedOpenSslEngine.addCredential by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16979](https://redirect.github.com/netty/netty/pull/16979) > * IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout by [`@husseinvr97`](https://github.com/husseinvr97) in [netty/netty#16982](https://redirect.github.com/netty/netty/pull/16982) > * Fix typo in AbstractSniHandler Javadoc by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#16988](https://redirect.github.com/netty/netty/pull/16988) > * Fix client/server inconsistency in SslCredential support matrix by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16990](https://redirect.github.com/netty/netty/pull/16990) > * Reconcile `AbstractCoalescingBufferQueue` readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by [`@gavinbunney`](https://github.com/gavinbunney) in [netty/netty#16947](https://redirect.github.com/netty/netty/pull/16947) > * Use Ticker in Http2MaxRstFrameListener for testability by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16993](https://redirect.github.com/netty/netty/pull/16993) > * Reset UTF-8 decode state on CR in StompSubframeDecoder by [`@vasiliy-mikhailov`](https://github.com/vasiliy-mikhailov) in [netty/netty#16991](https://redirect.github.com/netty/netty/pull/16991) > * FastLz: Guard decompression against truncated input by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17000](https://redirect.github.com/netty/netty/pull/17000) > * Reject non-token characters in HTTP/2 header names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16762](https://redirect.github.com/netty/netty/pull/16762) > * Auto-port 4.2: Fix SelfSignCertificate initialization in tests by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#17029](https://redirect.github.com/netty/netty/pull/17029) > * Enable extension of Http3ClientConnectionHandler to support higher-level protocols such as WebTransport. by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#17027](https://redirect.github.com/netty/netty/pull/17027) > * Implement Adaptive Cumulator by [`@shivaspeaks`](https://github.com/shivaspeaks) in [netty/netty#16731](https://redirect.github.com/netty/netty/pull/16731) > * Allow WebSocket extension negotiation to be disabled per response by [`@mkurz`](https://github.com/mkurz) in [netty/netty#17030](https://redirect.github.com/netty/netty/pull/17030) > * Support QPACK sensitivity detector for Never Indexed header fields by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17026](https://redirect.github.com/netty/netty/pull/17026) > * Fix maxAllocation for brotli-encoded content in HttpContentDecompressor by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17037](https://redirect.github.com/netty/netty/pull/17037) > * Pin github actions to reduce risk by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17043](https://redirect.github.com/netty/netty/pull/17043) ... (truncated) Commits * [`3703d79`](netty/netty@3703d79) [maven-release-plugin] prepare release netty-4.2.16.Final * [`63bbb2c`](netty/netty@63bbb2c) Update rust toolchain - add required parameters * [`ac06c1b`](netty/netty@ac06c1b) Update rust toolchain * [`5b68c61`](netty/netty@5b68c61) Merge branches from forks ([#17063](https://redirect.github.com/netty/netty/issues/17063)) * [`de5d276`](netty/netty@de5d276) Update lz4-java to 1.11.1 ([#17061](https://redirect.github.com/netty/netty/issues/17061)) * [`da22048`](netty/netty@da22048) Pin github actions to reduce risk ([#17043](https://redirect.github.com/netty/netty/issues/17043)) * [`0332676`](netty/netty@0332676) Fix maxAllocation for brotli-encoded content in HttpContentDecompressor ([#17037](https://redirect.github.com/netty/netty/issues/17037)) * [`7364401`](netty/netty@7364401) Support QPACK sensitivity detector for Never Indexed header fields ([#17026](https://redirect.github.com/netty/netty/issues/17026)) * [`06faf18`](netty/netty@06faf18) Allow WebSocket extension negotiation to be disabled per response ([#17030](https://redirect.github.com/netty/netty/issues/17030)) * [`bc4b983`](netty/netty@bc4b983) Implement Adaptive Cumulator ([#16731](https://redirect.github.com/netty/netty/issues/16731)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.15.Final...netty-4.2.16.Final) Updates `io.netty:netty-handler` from 4.2.15.Final to 4.2.16.Final Release notes *Sourced from [io.netty:netty-handler's releases](https://github.com/netty/netty/releases).* > netty-4.2.16.Final > ------------------ > > What's Changed > -------------- > > * Document Java 9 requirement for io\_uring by [`@jchambers`](https://github.com/jchambers) in [netty/netty#16904](https://redirect.github.com/netty/netty/pull/16904) > * Add BlockHound exception for DnsQueryIdSpace by [`@violetagg`](https://github.com/violetagg) in [netty/netty#16896](https://redirect.github.com/netty/netty/pull/16896) > * Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16901](https://redirect.github.com/netty/netty/pull/16901) > * Add epoch-based chunk cache purge with ring buffer for thread-local reuse by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16766](https://redirect.github.com/netty/netty/pull/16766) > * Use Splittable/ThreadLocalRandom to generate bulk data in tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16808](https://redirect.github.com/netty/netty/pull/16808) > * Auto-port 4.2: SingleThreadEventExecutor: document Throwable safety contract on run() by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16909](https://redirect.github.com/netty/netty/pull/16909) > * Auto-port 4.2: Make HTTP/2 frame hashCode consistent with equals by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16910](https://redirect.github.com/netty/netty/pull/16910) > * Auto-port 4.2: MQTT: Make the decodeProperties early-REPLAY check actually fire by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#16919](https://redirect.github.com/netty/netty/pull/16919) > * IoUring: fix io\_uring datagram writes with non-zero readerIndex by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16905](https://redirect.github.com/netty/netty/pull/16905) > * Exclude internal events from IoHandler.run() return value in epoll, io\_uring and kqueue by [`@franz1981`](https://github.com/franz1981) in [netty/netty#16848](https://redirect.github.com/netty/netty/pull/16848) > * IoUring: Pass IORING\_ENTER\_NO\_IOWAIT to report accurate CPU usage by [`@wineway`](https://github.com/wineway) in [netty/netty#16739](https://redirect.github.com/netty/netty/pull/16739) > * Avoid logging exceptions that tests ignore by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16891](https://redirect.github.com/netty/netty/pull/16891) > * Reject control characters at the boundary of HTTP method names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16723](https://redirect.github.com/netty/netty/pull/16723) > * IoUring: fix TCP Fast Open initial writes with readerIndex and composites by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#16929](https://redirect.github.com/netty/netty/pull/16929) > * Try to fix/stabilize a number of flaky tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#16934](https://redirect.github.com/netty/netty/pull/16934) > * Fix propagation of startTls for client SslContext handlers by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16931](https://redirect.github.com/netty/netty/pull/16931) > * Update to latest tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16936](https://redirect.github.com/netty/netty/pull/16936) > * Move test to shared testsuite by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16928](https://redirect.github.com/netty/netty/pull/16928) > * [Refactor] Useful helper method getOrDefault & cleaner abstraction by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#16927](https://redirect.github.com/netty/netty/pull/16927) > * Make permessage-deflate server window size and memLevel configurable by [`@fru1tworld`](https://github.com/fru1tworld) in [netty/netty#16809](https://redirect.github.com/netty/netty/pull/16809) > * Return early in DnsQueryContext.writeQuery when the query ID space is exhausted by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16950](https://redirect.github.com/netty/netty/pull/16950) > * Fix HTTP 2 PUSH\_PROMISE stream association validation by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16952](https://redirect.github.com/netty/netty/pull/16952) > * Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16951](https://redirect.github.com/netty/netty/pull/16951) > * Http3FrameCodec handle fragmented payloads when skipping unknown frames by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16960](https://redirect.github.com/netty/netty/pull/16960) > * Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by [`@hyperxpro`](https://github.com/hyperxpro) in [netty/netty#16932](https://redirect.github.com/netty/netty/pull/16932) > * Strictly validate MQTT UTF-8 Encoded String by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16939](https://redirect.github.com/netty/netty/pull/16939) > * Stop DateFormatter trailing token from running past the parse end by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16958](https://redirect.github.com/netty/netty/pull/16958) > * IpFilter: Deprecate constructor which use accept by default by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#16961](https://redirect.github.com/netty/netty/pull/16961) > * Add RFC 10008 QUERY Method support by [`@desiderantes`](https://github.com/desiderantes) in [netty/netty#16966](https://redirect.github.com/netty/netty/pull/16966) > * Correctly release and fail queued traffic-shaping writes on close by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16959](https://redirect.github.com/netty/netty/pull/16959) > * Reject control characters at the boundary of the HTTP version token by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#16971](https://redirect.github.com/netty/netty/pull/16971) > * FlowControlHandler: respect auto-read when toggled while dequeueing by [`@schiemon`](https://github.com/schiemon) in [netty/netty#16949](https://redirect.github.com/netty/netty/pull/16949) > * Fix leak in ReferenceCountedOpenSslEngine.addCredential by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16979](https://redirect.github.com/netty/netty/pull/16979) > * IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout by [`@husseinvr97`](https://github.com/husseinvr97) in [netty/netty#16982](https://redirect.github.com/netty/netty/pull/16982) > * Fix typo in AbstractSniHandler Javadoc by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#16988](https://redirect.github.com/netty/netty/pull/16988) > * Fix client/server inconsistency in SslCredential support matrix by [`@jmcrawford45`](https://github.com/jmcrawford45) in [netty/netty#16990](https://redirect.github.com/netty/netty/pull/16990) > * Reconcile `AbstractCoalescingBufferQueue` readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by [`@gavinbunney`](https://github.com/gavinbunney) in [netty/netty#16947](https://redirect.github.com/netty/netty/pull/16947) > * Use Ticker in Http2MaxRstFrameListener for testability by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#16993](https://redirect.github.com/netty/netty/pull/16993) > * Reset UTF-8 decode state on CR in StompSubframeDecoder by [`@vasiliy-mikhailov`](https://github.com/vasiliy-mikhailov) in [netty/netty#16991](https://redirect.github.com/netty/netty/pull/16991) > * FastLz: Guard decompression against truncated input by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17000](https://redirect.github.com/netty/netty/pull/17000) > * Reject non-token characters in HTTP/2 header names by [`@daguimu`](https://github.com/daguimu) in [netty/netty#16762](https://redirect.github.com/netty/netty/pull/16762) > * Auto-port 4.2: Fix SelfSignCertificate initialization in tests by [`@netty-project-bot`](https://github.com/netty-project-bot) in [netty/netty#17029](https://redirect.github.com/netty/netty/pull/17029) > * Enable extension of Http3ClientConnectionHandler to support higher-level protocols such as WebTransport. by [`@sanjomo`](https://github.com/sanjomo) in [netty/netty#17027](https://redirect.github.com/netty/netty/pull/17027) > * Implement Adaptive Cumulator by [`@shivaspeaks`](https://github.com/shivaspeaks) in [netty/netty#16731](https://redirect.github.com/netty/netty/pull/16731) > * Allow WebSocket extension negotiation to be disabled per response by [`@mkurz`](https://github.com/mkurz) in [netty/netty#17030](https://redirect.github.com/netty/netty/pull/17030) > * Support QPACK sensitivity detector for Never Indexed header fields by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17026](https://redirect.github.com/netty/netty/pull/17026) > * Fix maxAllocation for brotli-encoded content in HttpContentDecompressor by [`@skyguard1`](https://github.com/skyguard1) in [netty/netty#17037](https://redirect.github.com/netty/netty/pull/17037) > * Pin github actions to reduce risk by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17043](https://redirect.github.com/netty/netty/pull/17043) ... (truncated) Commits * [`3703d79`](netty/netty@3703d79) [maven-release-plugin] prepare release netty-4.2.16.Final * [`63bbb2c`](netty/netty@63bbb2c) Update rust toolchain - add required parameters * [`ac06c1b`](netty/netty@ac06c1b) Update rust toolchain * [`5b68c61`](netty/netty@5b68c61) Merge branches from forks ([#17063](https://redirect.github.com/netty/netty/issues/17063)) * [`de5d276`](netty/netty@de5d276) Update lz4-java to 1.11.1 ([#17061](https://redirect.github.com/netty/netty/issues/17061)) * [`da22048`](netty/netty@da22048) Pin github actions to reduce risk ([#17043](https://redirect.github.com/netty/netty/issues/17043)) * [`0332676`](netty/netty@0332676) Fix maxAllocation for brotli-encoded content in HttpContentDecompressor ([#17037](https://redirect.github.com/netty/netty/issues/17037)) * [`7364401`](netty/netty@7364401) Support QPACK sensitivity detector for Never Indexed header fields ([#17026](https://redirect.github.com/netty/netty/issues/17026)) * [`06faf18`](netty/netty@06faf18) Allow WebSocket extension negotiation to be disabled per response ([#17030](https://redirect.github.com/netty/netty/issues/17030)) * [`bc4b983`](netty/netty@bc4b983) Implement Adaptive Cumulator ([#16731](https://redirect.github.com/netty/netty/issues/16731)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.15.Final...netty-4.2.16.Final) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

franz1981 requested changes May 5, 2026

View reviewed changes

daguimu added 2 commits May 11, 2026 17:09

daguimu force-pushed the fix/http-method-reject-control-chars-15047 branch from 5daffbc to 295dcd9 Compare May 11, 2026 09:09

franz1981 requested changes May 11, 2026

View reviewed changes

daguimu added 2 commits May 11, 2026 18:13

Use HTTP token validation facade for HttpMethod

0a31c70

Release decoded requests in HttpMethod tests

950f44e

chrisvest reviewed Jun 9, 2026

View reviewed changes

Comment thread codec-http/src/test/java/io/netty/handler/codec/http/HttpMethodTest.java Outdated

chrisvest reviewed Jun 9, 2026

View reviewed changes

Comment thread codec-http/src/main/java/io/netty/handler/codec/http/HttpMethod.java Outdated

chrisvest approved these changes Jun 9, 2026

View reviewed changes

chrisvest added this to the 4.2.16.Final milestone Jun 9, 2026

chrisvest added the needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. label Jun 9, 2026

chrisvest merged commit 6ad888e into netty:4.2 Jun 9, 2026
21 checks passed

netty-project-bot mentioned this pull request Jun 9, 2026

Auto-port 5.0: Reject control characters at the boundary of HTTP method names #16926

Merged

github-actions Bot removed the needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. label Jun 9, 2026

chrisvest added the needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. label Jun 10, 2026

chrisvest removed the needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. label Jun 10, 2026

daguimu deleted the fix/http-method-reject-control-chars-15047 branch June 11, 2026 01:04

This was referenced Jun 17, 2026

HttpRequestDecoder silently accepts control characters in the HTTP version token #16970

Closed

Reject control characters at the boundary of the HTTP version token #16971

Merged

netty-project-bot mentioned this pull request Jun 23, 2026

Auto-port 5.0: Reject control characters at the boundary of the HTTP version token #16981

Merged

normanmaurer mentioned this pull request Jun 24, 2026

Reject control characters at the boundary of the HTTP version token (#16971) #16986

Merged

dongjoon-hyun mentioned this pull request Jul 8, 2026

[SPARK-58039] Upgrade Netty to 4.2.16.Final apache/spark-kubernetes-operator#750

Closed

Uh oh!

Conversation

daguimu commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Root Cause

Fix

Tests Added

Impact

Uh oh!

franz1981 May 5, 2026

Choose a reason for hiding this comment

Uh oh!

daguimu May 6, 2026

Choose a reason for hiding this comment

Uh oh!

daguimu commented May 11, 2026

Uh oh!

franz1981 May 11, 2026

Choose a reason for hiding this comment

Uh oh!

daguimu May 11, 2026

Choose a reason for hiding this comment

Uh oh!

chrisvest commented Jun 9, 2026

Uh oh!

daguimu commented Jun 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chrisvest commented Jun 9, 2026

Uh oh!

netty-project-bot commented Jun 9, 2026

Uh oh!

normanmaurer commented Jun 10, 2026

Uh oh!

netty-project-bot commented Jun 10, 2026

Uh oh!

chrisvest commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

daguimu commented Apr 29, 2026 •

edited

Loading