[aikido-autofix]

Upgrade Netty and Reactor dependencies to fix open redirect/SSRF vulnerabilities in URL parsing and HTTP/1-to-HTTP/2 conversion host validation bypass attacks.

⚠️ Breaking changes analysis not available for: io.projectreactor.netty:reactor-netty-http, io.projectreactor:reactor-core, io.projectreactor.netty:reactor-netty-core

✅ No breaking changes for: io.netty:netty-codec-http2, io.netty:netty-handler, io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-http, io.netty:netty-codec-socks, io.netty:netty-codec, io.netty:netty-codec-dns

✅ 37 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2024-22262	HIGH	[spring-core] UriComponentsBuilder fails to properly parse externally provided URLs, allowing attackers to bypass host validation checks and conduct open redirect or SSRF attacks.
CVE-2024-22243	HIGH	[spring-core] UriComponentsBuilder fails to properly validate URLs parsed from external input, allowing attackers to bypass host validation checks and potentially perform open redirect or SSRF attacks.
CVE-2024-22259	HIGH	[spring-core] Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  atta...
CVE-2024-38809	LOW	[spring-core] Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-M...
AIKIDO-2024-10361	LOW	[spring-core] Affected versions of the package are vulnerable to improper handling of case sensitivity. The use of String.toLowerCase() introduces locale-dependent exceptions that can cause fields to be improperly protected, potentially allowing attackers to bypass security checks based on case...
AIKIDO-2026-592216	HIGH	[netty-codec-http2] In HTTP/1-to-HTTP/2 conversion, HttpConversionUtil.toHttp2Headers() prioritizes the HTTP/1 Host header over the authority carried in an absolute-form request-target, contrary to RFC 9112 which requires the request-target authority to take precedence. A request such as `GET...
AIKIDO-2026-918525	HIGH	[netty-codec-http2] During HTTP/1-to-HTTP/2 conversion, HttpConversionUtil.toHttp2Headers() does not special-case an HTTP/1 CONNECT request in authority-form. Instead of deriving :authority from the CONNECT request-target, it uses the HTTP/1 Host header, producing a malformed HTTP/2 CONNECT...
AIKIDO-2026-58442	HIGH	[netty-codec-http2] When converting HTTP/2 Extended CONNECT requests to HTTP/1.1, Netty downgrades them to ordinary CONNECT tunnels by dropping the :protocol pseudo-header and the Extended-CONNECT :path. A request carrying :protocol=websocket and :path=/admin/ws to `:authority=ws.example:...
AIKIDO-2026-739270	MEDIUM	[netty-codec-http2] Netty's HTTP/2 content decompression via DelegatingDecompressorFrameListener leaks direct ByteBuf memory when a remote peer sends DATA frames for a stream whose decompressor channel has already been closed. In Http2Decompressor.decompress(...), data.retain() incremen...
AIKIDO-2026-453463	LOW	[netty-codec-http2] Netty's HTTP/2 stack does not validate header field values by default: names use a validator but values default to no validation and the encode path performs no checks. Prohibited octets such as NUL, CR, and LF therefore pass through verbatim on inbound and outbound HTTP/2 hea...
AIKIDO-2026-275094	LOW	[netty-codec-http2] A remote client can send an HTTP/2 SETTINGS frame advertising an extremely large header-table size, which DefaultHttp2HeadersEncoder accepts without a cap. The HpackEncoder then retains every unique outbound header indefinitely, degrading header lookups to O(n^2). Throughp...
CVE-2026-75595	HIGH	[netty-handler] Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans ...
CVE-2026-75596	LOW	[netty-handler] Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHa...
AIKIDO-2026-445867	HIGH	[netty-handler] Netty contains a vulnerability in TLS ClientHello parsing that can cause the server to select the default SslContext instead of the intended SNI-specific one. In deployments that rely solely on SNI-selected SslContexts to enforce mutual TLS (mTLS), where the default context do...
AIKIDO-2026-421700	HIGH	[netty-handler] Netty's OpenSSL client path adds hostname verification to a plain X509TrustManager by wrapping it, and on the OpenSSL provider that wrapping relies on Unsafe-based reflection. On Java 25 and later Unsafe is unavailable by default, so the wrapping silently fails and the unwra...
CVE-2026-10050	HIGH	[jetty-security] In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If t...
CVE-2026-59903	HIGH	[netty-codec-http] Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or C...
CVE-2026-55831	MEDIUM	[netty-codec-http] Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique settin...
CVE-2026-59898	MEDIUM	[netty-codec-http] Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / `Upgra...
CVE-2026-59899	MEDIUM	[netty-codec-http] Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque<CharSequence> named `acceptEncodi...
CVE-2026-56746	MEDIUM	[netty-codec-http] Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shor...
CVE-2026-59921	MEDIUM	[netty-codec-http] Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIM...
CVE-2026-55833	LOW	[netty-codec-http] SPDY header decoding continues inflating zlib-compressed data after exceeding maxHeaderSize, allowing remote attackers to cause compression-amplified DoS through CPU and memory exhaustion via crafted HEADERS frames.
CVE-2026-56745	LOW	[netty-codec-http] Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing...
CVE-2026-56819	HIGH	[netty-codec-http2] Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications tha...
CVE-2026-59900	MEDIUM	[netty-codec-http2] Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter) fails to deduplicate or validate Host he...
AIKIDO-2026-664762	HIGH	[netty-codec-http] This row consolidates the HTTP/1.x (netty-codec-http) security fixes in this release. GHSA-pvjx-v7vp-62vq: HttpServerCodec spills pipelined request methods into an unbounded overflow queue, so a client that pipelines many requests without reading responses exhausts heap. GH...
AIKIDO-2026-179204	HIGH	[netty-codec-http] HttpServerCodec pairs each outbound response to a request by polling the recorded request method, including for 1xx interim responses. When pipelined GET and HEAD requests are combined with a client sending Expect: 100-continue, responses are mismatched to requests: the HEA...
AIKIDO-2026-240696	HIGH	[netty-codec-socks] Netty's SOCKS4 and SOCKS5 client encoders write domain, userid, and credential fields without rejecting null bytes or CRLF sequences. In SOCKS5 a null byte truncates the intended hostname, allowing domain spoofing, and null or CRLF in credentials can bypass authentication. In ...
CVE-2026-59901	MEDIUM	[netty-codec] Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently capt...
CVE-2026-73508	MEDIUM	[netty-codec-dns] Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressD...
AIKIDO-2026-980617	MEDIUM	[reactor-netty-http] reactor-netty-http can leak credentials during a WebSocket handshake redirect to a different origin. This happens when the HTTP client is explicitly configured to follow redirects. A remote party that triggers such a redirect can receive credentials meant for the original h...
AIKIDO-2026-718872	MEDIUM	[reactor-netty-http] reactor-netty-http can mis-evaluate the remote IP address when HAProxy Protocol is enabled. Access-control or logging decisions that trust that address may then use the wrong client identity. The issue only applies when the server is configured to use HAProxy Protocol. The ...
AIKIDO-2026-556582	LOW	[reactor-netty-http] reactor-netty-http consumes excessive memory when a client sends HTTP/1.1 pipelined requests on a single connection. A remote sender can degrade or exhaust the server by pipelining many requests. Availability of other connections is then reduced. The patch bounds memory use...
AIKIDO-2026-268979	MEDIUM	[reactor-core] reactor-core Flux.windowTimeout with fair backpressure can hang after a 20-bit index wrap on a long-lived stream. A client that keeps the stream open and manipulates read speed can stop element processing without an error. Held subscriptions then exhaust resources. The patch pr...
AIKIDO-2026-224455	MEDIUM	[reactor-core] A race condition in Flux.bufferTimeout with fair backpressure can cause the stream to hang when upstream items arrive during buffer flushing, leaving items unprocessed. An attacker can exploit this to exhaust subscriptions, resulting in denial of service.
AIKIDO-2026-592409	LOW	[reactor-netty-core] A DNS resolver configuration can be incorrectly reused across multiple dynamically created clients with different resolver settings, causing traffic to be routed to unintended destinations. This allows an attacker to perform DNS hijacking or traffic redirection attacks.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-21595
• https://aikido.atlassian.net/browse/AIK-21290

🤖 Remediation details

Bump reactor-netty-http, spring-web, and transitive Netty/Reactor dependencies to address multiple CVEs

Short summary

This PR fixes security vulnerabilities in the following packages: io.netty:netty-codec-http2, io.netty:netty-handler, io.netty:netty-codec-http, io.netty:netty-codec-socks, io.netty:netty-codec, io.netty:netty-codec-dns, io.projectreactor.netty:reactor-netty-http, io.projectreactor.netty:reactor-netty-core, io.projectreactor:reactor-core, and org.springframework:spring-web. All vulnerable packages appear in agent/build.gradle as direct compileOnly dependencies or as transitives pulled through them; the resolved versions are recorded in agent/gradle.lockfile.

io.netty:netty-codec-http2

netty-codec-http2 was resolved transitively at 4.1.135.Final via the direct dependency io.projectreactor.netty:reactor-netty-http:1.2.18. Bumping reactor-netty-http to 1.3.8 in agent/build.gradle caused Gradle to resolve the entire Netty family at 4.2.19.Final, which exceeds the minimum patched version of 4.1.138.Final required to close the relevant advisories.

io.netty:netty-handler

netty-handler was resolved transitively at 4.1.135.Final through reactor-netty-core:1.2.18, itself a transitive of reactor-netty-http:1.2.18. The bump of reactor-netty-http to 1.3.8 pulls in reactor-netty-core:1.3.8, which declares netty-handler:4.2.19.Final, satisfying the patched floor of 4.1.137.Final.

io.netty:netty-codec-http

netty-codec-http was resolved transitively at 4.1.135.Final via reactor-netty-http:1.2.18. Bumping reactor-netty-http to 1.3.8 resolves netty-codec-http at 4.2.19.Final, which meets the patched floor of 4.1.137.Final required to address the multiple HTTP codec advisories.

io.netty:netty-codec-socks

netty-codec-socks was resolved transitively at 4.1.135.Final through reactor-netty-core:1.2.18 → netty-handler-proxy. The bump of reactor-netty-http to 1.3.8 (and thus reactor-netty-core to 1.3.8) resolves netty-codec-socks at 4.2.19.Final, satisfying the patched floor of 4.1.137.Final.

io.netty:netty-codec

netty-codec was resolved transitively at 4.1.135.Final as a dependency of several Netty artifacts pulled in by reactor-netty-http:1.2.18. The bump to reactor-netty-http:1.3.8 resolves netty-codec at 4.2.19.Final, meeting the patched floor of 4.1.136.Final.

io.netty:netty-codec-dns

netty-codec-dns was resolved transitively at 4.1.135.Final via reactor-netty-http:1.2.18 → netty-resolver-dns. Bumping reactor-netty-http to 1.3.8 resolves netty-codec-dns at 4.2.19.Final, satisfying the patched floor of 4.1.136.Final.

io.projectreactor.netty:reactor-netty-http

reactor-netty-http is declared directly in agent/build.gradle as compileOnly 'io.projectreactor.netty:reactor-netty-http:1.2.18' and is the owning parent for all the Netty transitive vulnerabilities listed above. The version was bumped to 1.3.8 — the smallest release that resolves all downstream Netty artifacts at or above their respective patched floors and also satisfies the reactor-netty-http advisory requiring >=1.3.7.

io.projectreactor.netty:reactor-netty-core

reactor-netty-core was resolved transitively at 1.2.18 as a direct dependency of reactor-netty-http:1.2.18. Bumping reactor-netty-http to 1.3.8 pulls in reactor-netty-core:1.3.8, which satisfies the patched floor of 1.3.7 required by the relevant advisory.

io.projectreactor:reactor-core

reactor-core was resolved transitively at 3.7.19 via reactor-netty-core:1.2.18. Bumping reactor-netty-http to 1.3.8 causes reactor-netty-core:1.3.8 to declare reactor-core:3.8.8, which satisfies the patched floor of 3.8.7 required by the relevant advisories.

org.springframework:spring-web

spring-web is declared directly in agent/build.gradle as compileOnly 'org.springframework:spring-web:5.3.20'. The version was bumped to 5.3.39 — the highest published 5.3.x release — which satisfies the patched floors for all Spring Framework CVEs addressed here (5.3.32, 5.3.33, 5.3.34, 5.3.38). The co-resolved Spring artifacts spring-beans, spring-core, and spring-jcl moved to 5.3.39 as a result of the same lockfile refresh.

Version changes

Package	From	To	Why updated
io.projectreactor.netty:reactor-netty-http	1.2.18	1.3.8	Direct CVE fix; owning parent for all Netty transitives
io.projectreactor.netty:reactor-netty-core	1.2.18	1.3.8	Transitive after reactor-netty-http bump
io.projectreactor:reactor-core	3.7.19	3.8.8	Transitive after reactor-netty-core bump; fixes reactor-core advisories
io.netty:netty-codec-http2	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump; direct CVE fix
io.netty:netty-codec-http	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump; direct CVE fix
io.netty:netty-handler	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-core bump; direct CVE fix
io.netty:netty-codec-socks	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-core bump; direct CVE fix
io.netty:netty-codec	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump; direct CVE fix
io.netty:netty-codec-dns	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump; direct CVE fix
io.netty:netty-buffer	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-common	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-transport	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-handler-proxy	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-core bump
io.netty:netty-resolver	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-resolver-dns	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-resolver-dns-classes-macos	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-resolver-dns-native-macos	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-transport-classes-epoll	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-transport-native-epoll	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-transport-native-unix-common	4.1.135.Final	4.2.19.Final	Transitive after reactor-netty-http bump
io.netty:netty-codec-http3	(not previously locked)	4.2.19.Final	New transitive introduced by reactor-netty-http 1.3.x
io.netty:netty-codec-base	(not previously locked)	4.2.19.Final	New transitive introduced by Netty 4.2.x family
io.netty:netty-codec-compression	(not previously locked)	4.2.19.Final	New transitive introduced by Netty 4.2.x family
io.netty:netty-codec-classes-quic	(not previously locked)	4.2.19.Final	New transitive introduced by Netty 4.2.x family
org.springframework:spring-web	5.3.20	5.3.39	Direct CVE fix
org.springframework:spring-beans	5.3.20	5.3.39	Transitive after spring-web bump
org.springframework:spring-core	5.3.20	5.3.39	Transitive after spring-web bump
org.springframework:spring-jcl	5.3.20	5.3.39	Transitive after spring-web bump
org.jspecify:jspecify	(not previously locked)	1.0.1	New transitive introduced by reactor-netty 1.3.x