Upgrade Netty library to 4.1.136.Final on 2.46.x

[pradeepagrawal8184]

Describe the bug

awssdk v2.46.21 has a dependency on Netty [4.1.135.Final]

Can these dependencies be upgraded, please?

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

Dependency scan doesn't detect any vulnerabilities.

Current Behavior

Dependency scan currently detects vulnerability GHSA-2c5c-chwr-9hqw in Netty libraries.

Reproduction Steps

Run a vulnerability scan.

Possible Solution

No response

Additional Information/Context

No response

AWS Java SDK version used

2.46.21

JDK version used

17

Operating System and version

All

[bhoradc]

Hi @pradeepagrawal8184 , thanks for the report, a couple of things on this one:

The advisory GHSA-2c5c-chwr-9hqw is against io.netty:netty-codec-http3 on the 4.2.x line. The SDK is still on Netty 4.1.x and doesn't pull in io.netty:netty-codec-http3, so v2.46.21 isn't actually exposed to it.

Separately, we did bump to 4.1.136.Final last week which is available in v2.49.0+. Upgrading the SDK will pick that up, but it won't fix the above CVE. This one appears to be a false positive.

Regards,
Chaitanya

[pradeepagrawal8184]

@bhoradc
What about : "CVE-2026-55831"
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

[debora-ito]

Netty was upgraded in Java SDK v2.49.0, please use a more recent SDK version and let us know if this helps with the vulnerability scan.

aws-sdk-java-v2/pom.xml

Line 122 in 03bb4e7

<netty.version>4.1.136.Final</netty.version>

Always a good practice to check the latest SDK version and see if the the library hasn't been upgraded already.

[pradeepagrawal8184]

@debora-ito : I already checked but will prefer to continue to minor upgrade as upgrading to 2.49.x needs additional effort.

[pradeepagrawal8184]

I also can't see 2.49.0 in the maven central repo

[EderJCosta]

I also can't see 2.49.0 in the maven central repo

Same here.

[debora-ito]

All Java SDK released versions are showing in the official Sonatype Central Repo. The mvnrepository is separate search engine with no relationship with the Sonatype Central Repo.

@pradeepagrawal8184 we usually don't backport changes to old minor versions, our releases are forward-only but newer 2.x versions are backwards-compatible, there should be no problem upgrading to 2.49.0. If you experience any issue please let us know.