Netty project

Netty 4.2.12.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.12.Final. This is a bug-fix release that fixes a regression introduced in 4.2.11.Final.

We strongly recommend upgrading to this version to get the security fixes included in 4.2.11.Final.

The security fixes are:

CVE-2026-33871 rated high. This is an HTTP/2 CONTINUATION frame flood Denial of Service vulnerability.
CVE-2026-33870 rated high. This is an HTTP/1.1 Request Smuggling vulnerability in chunked encoding parsing.

The regerssion fix is:

Revert "Eliminate redundant bounds checks in CompositeByteBuf accessors" (#16550)

For more details please see the complete release notes: https://github.com/netty/netty/releases/tag/netty-4.2.12.Final

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

@chrisvest

Netty 4.2.11.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.11.Final. This is a bug-fix and security-fix release.

The security fixes are:

CVE-2026-33871 rated high. This is an HTTP/2 CONTINUATION frame flood Denial of Service vulnerability.
CVE-2026-33870 rated high. This is an HTTP/1.1 Request Smuggling vulnerability in chunked encoding parsing.

The most important changes are:

Avoid allocation in HttpObjectEncoder.addEncodedLengthHex method (#16241)
Fix high-order bit aliasing in HttpUtil.validateToken (#16279)
Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO_READ=false (#16401)
Fix UnsupportedOperationException in readTrailingHeaders (#16412)
Allocate less in QueryStringDecoder.addParam for typical use case (#16527)
HTTP2: Correctly account for padding when decompress (#16264)
HTTP2: Pass the correct number of arguments when logging goaway (#16392)
HTTP2: Ensure preface is flushed in all cases (#16407)
Limit the number of Continuation frames per HTTP2 Headers (#16536)
HTTP3: Allow to support non-standard HTTP3 settings (#16171)
Fire the QuicChannel datagram extension event before the channel becomes active (#16425)
Support QuicheQuicSslEngine hostname identification algorithm. (#16426)
Expose QuicSslContextBuilder::sni (#16178)
Allow to set destination connection id when creating a client side QuicheChannel (#16286)
Add javadoc to clarify responsibility of the user when generating the remote connection id (#16293)
Allocate one large segment and slice for each MsgHdrMemory (#16234)
Improve multi-byte access performance when UNALIGNED availability is unknown (#16207)
fix: the precedence of + is higher than >> (#16312)
AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater than byteBuf.maxCapacity() (#16309)
AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed (#16327)
Recycler should not use thread locals unless they get cleaned up (#16315)
Make unpooled buffers avoid shared arenas (#16443)
AdaptivePoolingAllocator: remove ensureAccessible() call in capacity(int) method (#16473)
Log value of io.netty.ignoreExpensiveClean property during initialization (#16479)
AbstractByteBuf._internalNioBuffer() might throw exception (#16423)
Eliminate redundant bounds checks in CompositeByteBuf accessors (#16525)
Avoid unpooled allocator in CloseWebSocketFrame (#16486)
Fix client_max_window_bits parameter handling in per message-deflate extension (#16424)
LocalChannel: Remove dependency on SingleThreadEventExecutor (#16393)
Local transport: shutdown hook should call closeNow to be consistent (#16406)
Remove unnecessary array access in DefaultAttributeMap.orderedCopyOnInsert (#16386)
QUIC: Correctly handle selection of alpn protos (#16484)
QUIC: Correctly handle malloc errors during ssl context creation (#16483)
QUIC: Don'l leak memory when context is detroyed (#16481)
Quic: Fix global reference leak (#16480)
Swap conditions to avoid native (#16389)
Support boringssl SSLCredential API (#15919)
Decrease Long allocations and map.put calls in ReferenceCountedOpenSllEngine in handshake() method (#16242)
Avoid unnecessary SSL.getVersion() call and string allocation in ReferenceCountedOpenSslEngine (#16278)
Don't assume CertificateFactory is thread-safe (#16350)
Make RefCntOpenSslContext.deallocate more robust (#16253)
OpenSSL: Don't leak OpenSslKeyManagerProvider on exception (#16337)
Kqueue: Correctly handle registrations (#16439)
Kqueue: Correctly use KqueueIoOps.data() when update change list (#16440)
Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported (#16441)
Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) (#16451)
Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry loop (#16245)
Epoll: Fix excessive CPU usage when Channel is only registered but no… (#16250)
Epoll: Add null checks for safety reasons (#16454)
Epoll: Use correct value to initialize mmsghdr.msg_namelen (#16460)
Epoll: Fix support for IP_RECVORIGDSTADDR (#16461)
Epoll / IoUring: setTcpMg5Sig(...) might overflow (#16511)
IoUring: Only complete deregistration promise once we received all completions (#16330)
IoUring: Don't use RDHUP for non stream Channel implementations (#16345)
IoUring: Fix buffer leak in DatagramChannel implementation when recv operation fails (#16359)
IoUring: Reduce unnecessary io_uring_enter syscalls on non-blocking path (#16259)
IoUring: Fix io_uring writev infinite loop on kernels without SENDMSG_ZC support (#16438)
IoUring: Correctly unregister native functions on OnLoad failure (#16487)
IoUring: Correctly handle the case when malloc fails during probe (#16501)
IoUring: Correctly unload native stuff (#16502)
IoUring: Use correct errno value in exception (#16500)
IoUring: Use more correct bitmask check (#16507)
IoUring: Correctly handle return value of sys_io_uring_register(...) while (#16508)
IoUring: Add NULL check for GetStringUTFChars(...) (#16509)
Native transports: Fix possible fd leak when fcntl fails. (#16442)
Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD (#16450)
Replace ClosedChannelException with StacklessClosedChannelException (#16506)
Enforce io.netty.maxDirectMemory accounting on all Java versions (#16489)
JdkZlibDecoder: accumulate decompressed output before firing channelRead (#16510)

For more details please see the complete release notes: https://github.com/netty/netty/releases/tag/netty-4.2.11.Final

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.132.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.132.Final. This is a bug-fix and security-fix release.

The security fixes are:

CVE-2026-33871 rated high. This is an HTTP/2 CONTINUATION frame flood Denial of Service vulnerability.
CVE-2026-33870 rated high. This is an HTTP/1.1 Request Smuggling vulnerability in chunked encoding parsing.

The most important changes are:

Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry loop (#16248)
Make RefCntOpenSslContext.deallocate more robust (#16257)
HTTP2: Correctly account for padding when decompress (#16265)
Fix high-order bit aliasing in HttpUtil.validateToken (#16303)
fix: the precedence of + is higher than >> (#16316)
AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater than byteBuf.maxCapacity() (#16320)
AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed (#16331)
Don't assume CertificateFactory is thread-safe (#16364)
Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO_READ=false (#16280)
HTTP2: Ensure preface is flushed in all cases (#16432)
Fix UnsupportedOperationException in readTrailingHeaders (#16437)
Fix client_max_window_bits parameter handling in permessage-deflate extension (#16435)
Native transports: Fix possible fd leak when fcntl fails. (#16446)
Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported (#16448)
Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) (#16459)
Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD (#16456)
Epoll: Add null checks for safety reasons (#16463)
Epoll: Use correct value to initialize mmsghdr.msg_namelen (#16467)
Epoll: Fix support for IP_RECVORIGDSTADDR (#16468)
AdaptivePoolingAllocator: remove ensureAccessible() call in capacity(int) method (#16475)
Epoll: setTcpMg5Sig(...) might overflow (#16520)
JdkZlibDecoder: accumulate decompressed output before firing channelRead (#16532)
Limit the number of Continuation frames per HTTP2 Headers (#13969)
Stricter HTTP/1.1 chunk extension parsing (#16537)

For more details please see the complete release notes: https://github.com/netty/netty/releases/tag/netty-4.1.132.Final

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/Quic 0.0.75.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.75.Final. This is a bug-fix release but also add some new advanced features.

The most important changes are:

Upgrade quiche version to get fix for bug that can cause packet drops (#831)
Include correct license informations for BoringSSL (#824)
Update jni-util version to clarify licensing (#825)
Implement Quic stream reset frame application protocol error code propagation (#842)
Add support for quiche_config_discover_pmtu (#839)
Fix codec-native-quic Bundle-SymbolicNames (#834)
Add missing return which could lead to double notification of a promise and so unexpected exception (#845)
Fix incorrect assert when handling id to channel mappings (#844)
Correctly return all TransportParameters (#843)
Allow to set destination connection id when creating a client side QuicChannel (#833)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.131.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.131.Final. This is a bug-fix release.

The most important changes are:

NioDatagramChannel.block(...) does not early return on failure (#16044)
Support for AWS Libcrypto (AWS-LC) netty-tcnative build (#16081)
codec-dns: Decompress MX RDATA exchange domain names during DNS record decoding (#16127)
Buddy allocation for large buffers in adaptive allocator (#16132)
SslHandler: Only resume on EventLoop if EventLoop is not shutting down already (#16149)
Wrap ECONNREFUSED in PortUnreachableException for UDP (#16150)
Bump com.ning:compress-lzf (4.1) (#16159)
Fix adaptive allocator bug from not noticing failed allocation (#16202)
Avoid loosing original read exception (#16204)
Backport multiple adaptive allocator changes (#16219) For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.10.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.10.Final, which is our first release this year. This is a bug-fix release which also fixes a regression introduced by 4.2.9.Final so please consider upgrading as soon as possible.

The most important changes are:

Reimplement IORING_OP_SENDMSG_ZC (#16130)
codec-dns: Decompress MX RDATA exchange domain names during DNS record decoding (#16040)
Buddy allocation for large buffers in adaptive allocator (#16053)
Improve adaptive allocator thread local performance (#15741)
Avoid UnsupportedOperationException in CompositeeByteBuf when noUnsafe is true (#16097)
NioDatagramChannel.block(...) does not early return on failure (#16044)
Set default maxFieldSectionSize to 16MB (#16088)
io_uring: submit send over write for sockets (#16095)
Limit QUIC stream and field section sizes to protocol max (#16117)
Avoid non-portable malloc-of-zero behavior (#16055)
Make AdaptiveByteBuf.setBytes faster (#15736)
allocation free AdaptiveByteBuf::setBytes(byte[]) (#16058)
fix: prevent DGC init failure if IpMulticastAll cannot be set (#16104)
Improve chunk picking for the large-size buddy allocator (#16179)
Fix adaptive allocator bug from not noticing failed allocation (#16200)
Avoid loosing original read exception (#16199)
Fix possible ClassCastException when using ReadOnlyAbstractByteBuf (#16188)
Update to Quiche 0.24.8 (#16182)
Fix incorrect assert when handling id to channel mappings (#16163)
Correctly return all TransportParameters (#16162)
Reduce allocations on DefaultHeaders::containsValue (#15843)
SslHandler: Only resume on EventLoop if EventLoop is not shutting down already (#16144)
Wrap ECONNREFUSED in PortUnreachableException for UDP (#16131)
Ensure ChannelPromise that are used by ChannelOutboundHandler will always complete in the assumed thread (#16052)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission

Netty 4.2.9.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.9.Final. This is a bug-fix release which also fixes a regression introduced by 4.2.8.Final so please consider upgrading as soon as possible.

The most important changes are:

Fix HTTP startline validation (#16022)
Fix MpscIntQueue bug (#16023) (#16023)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission

Netty 4.1.130.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.130.Final. This is a bug-fix release which also fixes a regression introduced by 4.1.129.Final so please consider upgrading as soon as possible.

The most important changes are:

Fix HTTP startline validation (#16024)
Fix MpscIntQueue bug (#16027)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.8.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.8.Final. This is a bug-fix release but also contains CVE-2025-67735

The most important changes are:

Correct codec-native-quic Fragment-Host (#16015)
Fix - Http3FrameCodec decode fail during unknown settings (#15998)
Discard the following HttpContent for preflight request (#15941)
Prevent ManualEventLoop to block on a racy task submission (#15937)
Fix race condition in NonStickyEventExecutorGroup causing incorrect inEventLoop() result (#15933)
Fix 15908 - Ignore unknown Http3Setting Identifier in Http3SettingsFrame (#15909)
Close Channel and fail bootstrap when setting a ChannelOption causes an error (#15896)
Ensure Arena.ofShared() is usable before assuming that we can use Arenas on JDK25 (#15877)
io_uring: Fix Unix domain socket support for abstract namespace sockets (#15876)
Fix Zstd compression for large data (#15861)
Fix ZstdEncoder not producing data when source is smaller than block size (#15859)
Make big endian ASCII hashcode consistent with little endian (#15847)
Implement Quic stream reset frame application protocol error code propagation (#15845)
Backward Compatible - Http3SettingsFrame abstraction (#15835)
Fix reentrancy bug in ByteToMessageDecoder (#15833)
Add close tracing to retain calls (#15832)
Enable X25519MLKEM768 by default for BoringSSL/AWS-LC (#15830)
Add 32k and 64k size classes to adaptive allocator (#15799)
Handle invalid content length in continue request (#15794)
Correct HTTP/2 padding length check (#15793)
Make org.bouncycastle.jce.provider.BouncyCastleProvider optional by deferring initialization (#15788)
Expose the list of supported io_uring features (#15785)
IoUring: Use IORING_SETUP_CQE_MIXED by default if possible (#15780)
Add :protocol pseudo-header support for Extended CONNECT (RFC 9220) (#15771)
Prevent allocation loops when LeakPresenceDetector ResourceScope is closed (#15768)
Fix AutoScalingEventExecutorChooser scale down when executor is not started (#15766)
Add support for IP_MULTICAST_ALL to EpollDatagramChannel and IOUringDatagramChannel (netty 4.2) (#15755)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission

Netty 4.1.129.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.129.Final. This is a bug-fix release but also contains CVE-2025-67735.

The most important changes are:

RLF injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder (CVE-2025-67735)
Update lz4-java version to 1.10.1 (#15981)
Close Channel and fail bootstrap when setting a ChannelOption causes an error (#15970)
Discard the following HttpContent for preflight request (#15962)
Fix race condition in NonStickyEventExecutorGroup causing incorrect inEventLoop() results (#15927)
Fix Zstd compression for large data (#15900)
Fix ZstdEncoder not producing data when source is smaller than block (#15894)
Make big endian ASCII hashcode consistent with little endian (#15846)
Fix reentrancy bug in ByteToMessageDecoder (#15834)
Add 32k and 64k size classes to adaptive allocator (#15800)
Re-enable reflective field accesses in native images (#15774)
Correct HTTP/2 padding length check (#15795)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.7.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.7.Final. This is a bug-fix release but also contains some new features. Beside this it also fixes CVE-2025-59419 which might affect you if you make use of our SMTP implementation.

The most important changes are:

SMTP Command Injection Vulnerability Allowing Email Forgery (CVE-2025-59419)
Faster leak detector implementation for tests (#15622)
Expose metrics from AutoScalingEventExecutorChooserFactory (#15624)
Teach the BoringSSL implementation to use a java.security.Signature for keys that cannot be obtained directly (#15626)
Drop unknown frame on missing stream in first packet (#15646)
IoUring: Add support IntegerUnixChannelOption and RawUnixChannelOption (#15706)
IoUring: Don't delay close operation if we still wait for the second notification when using zero copy (#15709)
IoUring: Only free resourcees once we are sure no more events are handled by the handle (#15710)
Fix Snappy compression bug (#15712)
Allow CertificateBuilder to specify Provider instance to use (#15722)
Fix aligned off-heap zeroing (#15740)
buffer: Fix JFR deadlock during ReturnChunkEvent initialization (#15740)
Fix concurrent chunk data write bug in adaptive allocator (#15652)
OpenSSL: Allow to configure named groups via SSLParameters on Java20+ (#15660)
Move polymorphic VarHandle calls to separate class to avoid Android verification error (#15661)
Kqueue: Ensure classes can be loaded even if native lib is not on the classpath or platform not supported (#15669)
buffer: centralize VarHandle byte[] access in VarHandleByteBufferAccess (#15670)
Epoll: Ensure classes can be loaded even if native lib is not on the classpath or platform not supported (#15671)
IoUring: Ensure classes can be loaded even if native lib is not on the classpath or platform not supported (#15672)
Update jni-util version to clarify licensing (#15687)
IoUring: Always correctly handle IORING_CQE_F_MORE flag when using zero copy send (#15692)
IoUring: Fix debug log message which shows which features are supported (#15693)

For more details please visit our bug tracker

Special notes

Faster leak detector implementation for tests

If you are using paranoid leak detection for unit testing, consider trying LeakPresenceDetector for more efficient leak detection. See (#15622) for more details.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission

Netty 4.1.128.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.128.Final. This is a bug-fix release but also contains CVE-2025-59419 which might affect you if you make use of our SMTP implementation.

The most important changes are:

SMTP Command Injection Vulnerability Allowing Email Forgery (CVE-2025-59419)
Drop unknown frame on missing stream in first packet (#15647)
Precompute segments offsets and use them as segment's identity (#15656)
Empty chunks cannot be used while allocating from the shared queue (#15659)
Only register chunk sizes in adaptive allocator (#15663)
Fix concurrent chunk data write bug in adaptive allocator (#15664)
Update jni-util version to clarify licensing (#15689)
Fix Snappy compression bug (#15715)
Fix aligned off-heap zeroing (#15744)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.6.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.6.Final. This is a bug-fix release which fixes a regression introduced by 4.2.5.Final that might affect you if you use BouncyCastle. We decided to do a quick follow-up release here so people that depend on it can still get the fixes for CVE-2025-58057 and CVE-2025-58056 that were part of 4.2.5.Final.

The most important changes are:

BouncyCastleAlpnSslUtils needs to use the correct SSLEngine class as otherwise it will fail to init static fields. (#15630)
IoUring: Allow to create IoHandlerFactory that supports changing the Thread and so supports AutoScalingEventExecutorChooserFactory. (#15608)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission * @chrisvest * @dreamlike-ocean * @georgebanasios * @jponge * @normanmaurer * @sberyozkin * @yawkat

Netty 4.1.127.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.127.Final. This is a bug-fix release which fixes a regression introduced by 4.1.126.Final that might affect you if you use BouncyCastle. We decided to do a quick follow-up release here so people that depend on it can still get the fixes for CVE-2025-58057 and CVE-2025-58056 that were part of 4.1.125.Final.

The most important changes are:

BouncyCastleAlpnSslUtils needs to use the correct SSLEngine class as otherwise it will fail to init static fields. (#15628)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.5.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.5.Final. This is a bug-fix release which also contains a 2 security fixes, CVE-2025-58057 and CVE-2025-58056.

The most important changes are:

Decompression codecs vulnerable to DoS via zip bomb style attack (CVE-2025-58057)
Request smuggling due to incorrect parsing of chunk extensions (CVE-2025-58056)
Only register chunk sizes in adaptive allocator (#15575)
Always load BouncyCastle classes with the Netty classloader (#15569)
Update to quiche 0.24.5 (#15556)
Clean up netty-buffer Import-Package (#15562)
Don't try to handle incomplete upgrade request (#15581)
SubmissionQueue::toString should iterate from the head (#15586)
Implement automatic scaling for EventLoopGroup threads (#15524)
Drop unknown frame on missing stream (#15592)
IoUring: Reduce redundant system calls (#15591)
IoUring: Always correctly handle result for zero copy (#15600)
Fix IllegalReferenceCountException on invalid upgrade response (#15602)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission * @brucelwl * @bryce-anderson * @chrisvest * @doom369 * @dreamlike-ocean * @franz1981 * @georgebanasios * @He-Pin * @isaacrivriv * @linking12 * @m1ngyuan * @normanmaurer * @rovarga * @scotthraban * @vietj * @violetagg * @yawkat

Netty 4.1.126.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.126.Final. This is a bug-fix release which also contains a 2 security fixes, CVE-2025-58057 and CVE-2025-58056.

The most important changes are:

Decompression codecs vulnerable to DoS via zip bomb style attack (CVE-2025-58057)
Request smuggling due to incorrect parsing of chunk extensions (CVE-2025-58056)
Fix IllegalReferenceCountException on invalid upgrade response (#15606)
Drop unknown frame on missing stream (#15595)
Don't try to handle incomplete upgrade request (#15585)
Make org.graalvm.nativeimage:svm optional in netty-common (#15558)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/Quic 0.0.74.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.73.Final. This is a bug-fix release but also upgrades its quiche version to fix CVE-2025-7054. Because of this we highly recommend to upgrade as soon as possible.

The most important changes are:

Correctly map GENERIC to UNKNOWN when using BoringSSL (#816)
Update to quiche 0.24.5 (#815)
Update netty dependency (#817)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/OHTTP 0.0.19.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-ohttp 0.0.19.Final. This is a bug-fix release.

The most important changes are:

Release buffer when serialization throws exception (#104)
Update to latest netty release (#106)

For more details related to this release see our bug-tracker.

Netty 4.2.4.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.4.Final. This is a bug-fix release which also contains a fix for a CVE-2025-55163.

The most important changes are:

MadeYouReset HTTP/2 DDoS vulnerability (CVE-2025-55163)
Add support for SOCKS5 private authentication methods (RFC#1928) (#15470)
IoUring: Add support for IORING_OP_SEND_ZC (#15491)
JFR profile and JFR reader for the allocation simulator (#15497)
Add namespace to our JFR events (#15500)
Fix NPE and AssertionErrors when many tasks are scheduled and cancelled (#15501)
IoUring: Detect completion queue overflow (#15505)
Fix JFR event names in the flight recorder profile (#15506)
Add close-tracking to our leak detector (#15512)
ByteBufOutputStream.writeBytes should only write lower-order bytes (#15514)
HTTP2: Http2ConnectionHandler should always use Http2ConnectionEncoder (#15516)
Add CompositeByteBuf.componentSlice() to return correctly indexed view (#15519)
Use optional dependency for svm (#15521)
Epoll: Correctly handle UDP packets with source port of 0. (#15528)
FastThreadLocal: Optimize fallback check for virtual threads to O(1) (#15532)
Fix netty-common OSGi Import-Package header (#15540)
IoUring: Correctly handle channel.config().setAutoRead(false) (#15541)
IoUring: Submit and process completions in a loop to ensure timely processing. (#15544)
MqttConnectPayload.toString() includes password (#15548)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission * @bryce-anderson * @chrisvest * @d-william * @dreamlike-ocean * @franz1981 * @galbarnahum * @georgebanasios * @He-Pin * @jbertram * @laosijikaichele * @linking12 * @normanmaurer * @rovarga * @sergiitk * @sunil-solace * @vietj * @violetagg * @yawkat

Netty 4.1.124.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.124.Final. This is a bug-fix release which also contains a fix for a CVE-2025-55163.

The most important changes are:

MadeYouReset HTTP/2 DDoS vulnerability (CVE-2025-55163)
Fix NPE and AssertionErrors when many tasks are scheduled and cancelled (#15499)
HTTP2: Http2ConnectionHandler should always use Http2ConnectionEncoder (#15518)
Epoll: Correctly handle UDP packets with source port of 0 (#15537)
Fix netty-common OSGi Import-Package header (#15546)
MqttConnectPayload.toString() includes password (#15554)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.123.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.123.Final. This is a bug-fix release but also contains various performance enhancements in the AdaptiveByteBufAllocator.

The most important changes are:

Fix chunk reuse bug in adaptive allocator (#15428)
More accurate adaptive memory usage accounting (#15425)
Introduce size-classes for the adaptive allocator (#15414)
Reduce magazine proliferation eagerness (#15422)
Fix concurrent ByteBuffer access issue in AdaptiveByteBuf.getBytes (#15410)
Fix possible buffer corruption caused by incorrect setCharSequence(...) implementation (#15393)
AdaptiveByteBuf: Fix AdaptiveByteBuf.maxFastWritableBytes() to take writerIndex() into account (#15376)
Optimize capacity bumping for adaptive ByteBufs (#15368)
AbstractDnsRecord: equals() and hashCode() to ignore name field's case (#15330)
Backport Unsafe guards (#15346)
Guard recomputed offset access with hasUnsafe (#15357)
HTTP2: Always produce a RST frame on stream exception (#15355)
Correct what artifacts included in netty-bom (#15308)

For more details please visit our bug tracker

Special note

AdaptiveByteBufAllocator improvements

The AdaptiveByteBufAllocator did see a lot of changes this release to not only fixing bugs but also decrease it's memory overhead dramatically. To ensure we don't regress in the future and also allow others to better understand the characteristics we also added an allocation pattern simulator. For some more details about the improvements please refer to #15429

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.3.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.3.Final. We put a lot of work into this release so please ensure to read on for all the changes / bugfixes / performance improvements.

The most important changes are:

IoUring: Correctly refetch completions that were produced because of inline submissions (#15480)
IoUring: Explicit set CQSIZE by default and use a much saner default for submission ring (#15477)
IoUring: Allow to configure what allocation strategy the buffer ring (#15469)
IoUring: Add IoUringBufferRingConfig.Builder (#15453)
Add property to turn off pinned memory tracker in PoolChunk (#15436)
Add JFR events for PooledByteBufAllocator (#15433)
More accurate adaptive memory usage accounting (#15423)
Fix chunk reuse bug in adaptive allocator (#15424)
Reduce magazine proliferation eagerness (#15421)
Introduce size-classes for the adaptive allocator (#15399)
Fix concurrent ByteBuffer access issue in AdaptiveByteBuf.getBytes (#15402)
Add malloc/free based Cleaner/CleanableDirectBuffer (#15366)
Adaptive: Fix possible buffer corruption caused by incorrect setCharSequence(...) implementation (#15391)
direct buffer preference should not depend on unsafe presence (#15381)
AdaptiveByteBuf: Fix AdaptiveByteBuf.maxFastWritableBytes() to take writerIndex into account (#15373)
JFR event support (#15369)
Fix bug in capacity(int) for the adaptive allocator (#15367)
Disable CleanerJava25 at build time for GraalVM <25 (#15325)
Only use MemorySegments on Java 25+ (#15338)
AbstractDnsRecord: equals() and hashCode() to ignore name field's case (#15329)
Guard recomputed offset access with hasUnsafe (#15354)
HTTP2: Always produce a RST frame on stream exception (#15352)
IoUring: Add the ability to allocate the buffers for the buffering in bulk (#15457)
Improved bound checks (#15452)

For more details please visit our bug tracker

Special notes

AdaptiveByteBufAllocator improvements

IoUring improvements

We continue to improve our io_uring based thransport as it is relative new. The improvements include adding new features but also just improve the performance in general. Beside this we also changed a few defaults to better reflect usual workloads. For more details on all the changes please refer to the changes listed above that are prefixed with IoUring.

JFR event support

We finally added JFR event support and added usafe of it for the AdaptiveByteBufAllocator and PooledByteBufAllocator. This allows to better understand the allocation pattern and memory usage of each of the allocators. We plan to add more and more support to other internals soon.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission

Netty/Incubator/Codec/Quic 0.0.73.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.73.Final. This is a bug-fix release but also upgrades its quiche version to fix CVE-2025-4820 and CVE-2025-4821. Because of this we highly recommend to upgrade as soon as possible.

The most important changes are:

Cleanup code to make stacktrace less confusing (#796)
Update to latest boringssl sha (#794)
Fix crash in Quiche when calling isClosed on freed connections (#798)
Fix incorrect handling of stream capacity greater than 2³² (#806)
Obtain correct cipher to generate the authentication method (#809)
Update to netty 4.1.122.Final (#810)
Update to quiche 0.24.4 (#811)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.2.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.2.Final. This is our second release for the 4.2 release train, including bug-fixes, performance enhancement and new features.

The most important changes are:

Graduate HTTP/3 from incubator (#15048)
Allows manually running tasks with timeout (in ns) (#15124)
Port over fix for crash in QUIC codec (in ns) (#15130)
Fix concurrent ByteBuf write access bug in adaptive allocator (#15131)
IoUring: Allow users to explicit enable RECVSEND_BUNDLE support (#15135)
Make EmbeddedChannel ticker configurable (#15141)
IoUring: Don't depend on the fact that ByteBuf.memoryAddress() works (#15142)
Always correctly calculate the memory address of the ByteBuf even if sun.misc.Unsafe is not usable (#15143)
Upgrade lz4 dependencies as the old version did not correctly handle ByteBuffer that have an arrayOffset > 0 (#15146)
Kqueue: Fix registration failure when fd is reused (#15150)
Fix incorrect assignment of SingleThreadIoEventLoop constructor (#15155)
Fix signing keys with ML-DSA in CertificateBuilder (#15156)
Optimize ByteBuf.setCharSequence for adaptive allocator (#15165)
IoUring: Providing Unix Domain Socket Support for IoUring (#15210)
Ensure OpenSsl.availableJavaCipherSuites does not contain null value (#15215)
Make JdkZlibEncoder accept Deflater.DEFAULT_COMPRESSION as level (#15217)
Add API to wrap virtual thread task for FastThreadLocal support (#15222)
Introduce ByteBuf.readString method (#15224)
Add support for creating direct ByteBuffers from MemorySegments (#15231)
Always prefer direct buffers for pooled allocators if not explicit disabled (#15232)
Update to netty-tcnative 2.0.72.Final (#15240)
IoUring:properly handle ERRNO_ECANCELED_NEGATIVE in splice (#15250)
Fix netty-buffer OSGi metadata (#15274)
Kqueue: Delay removal from registration map to fix noisy warnings (#15279)
StreamBufferingEncoder doesn't work when settings auto-ack is disabled (#15301)
Add SETTINGS_ENABLE_CONNECT_PROTOCOL to the default HTTP/2 settings (#15312)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission

Netty 4.1.122.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.122.Final. This is a bug-fix release.

The most important changes are:

DirContextUtils.addNameServer(...) should just catch Exception internally (#15108)
Make public API specify explicit maxAllocation to prevent OOM (#15122)
Fix concurrent ByteBuf write access bug in adaptive allocator (#15132)
Fix transport-native-kqueue Bundle-SymbolicNames (#15075)
Fix resolver-dns-native-macos Bundle-SymbolicNames (#15076)
Always correctly calculate the memory address of the ByteBuf even if sun.misc.Unsafe is not usable (#15144)
Upgrade lz4 dependencies as the old version did not correctly handle ByteBuffer that have an arrayOffset > 0 (#15147)
Optimize ByteBuf.setCharSequence for adaptive allocator (#15170)
Kqueue: Fix registration failure when fd is reused (#15162)
Make JdkZlibEncoder accept Deflater.DEFAULT_COMPRESSION as level (#15220)
Ensure OpenSsl.availableJavaCipherSuites does not contain null values (#15219)
Always prefer direct buffers for pooled allocators if not explicit disabled (#15245)
Update to netty-tcnative 2.0.72.Final (#15248)
Re-enable sun.misc.Unsafe by default on Java 24+ (#15296)
Kqueue: Delay removal from registration map to fix noisy warnings (#15293)

For more details please visit our bug tracker

Special note

We decided to enable sun.misc.Unsafe by default again when using JDK24+ (when possible) as disabling it by default on this java versions did come with quite a performance regression. For more details see (#15296). Be aware that this is only needed for 4.1.x, in 4.2.x we are able to fix this in another way that does not require the usage of sun.misc.Unsafe.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.1.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.2.1.Final. This is our first bug-fix release for the 4.2 release train.

The most important changes are:

Add necessary native-image configuration files (#14928)
Graduate the QUIC codec from incubator to Netty Core (#14979)
IoUring: Share IovArray to reduce jitter and allocations (#14996)
Optionally depend on bctls-jdk15on, take 2 (#14998)
Fix the issue where pendingTimeouts may be incorrect in the HashedWheelTimer (#15000)
SSL: Clear native error if named group is not supported (#15001)
ManualIoEventLoop: Correctly calculate delayNanos and deadlineNanos (#15002)
Make public API specify explicit maxAllocation to prevent OOM (#15005)
fix: Crash early on custom native workdir failure (#15009)
Add support for ML-KEM in CertificateBuilder (#15012)
Correct computation for suboptimal chunk retirement probability (#15015)
fix: WebSocketClientCompressionHandler shouldn't claim window bits support when jzlib is not available (#15018)
Add "unpadded" support to Base64 encoder/decoder (#15030)
Fix bug in method AdaptivePoolingAllocator.allocateWithoutLock(...) (#15031)
Fix a Bytebuf leak in TcpDnsQueryDecoder (#15033)
Add ticker to ManualIoEventLoop (#15043)
IoUring: Ensure that the buffer group is properly set before channel::read (#15054)
Fix transport-native-epoll Bundle-SymbolicNames (#15059)
ManualIoEventLoop.run(-1) should be handled like runNow() (#15064)
Fix transport-native-kqueue Bundle-SymbolicNames (#15065)
Fix transport-native-io_uring Bundle-SymbolicNames (#15066)
Fix resolver-dns-native-macos Bundle-SymbolicNames (#15067)
Fix init order of PlatformDependent0 fields (#15077)
Rename native lib so incubator version and new version can co-exists (#15098)
Update to netty-tcnative 2.0.71.Final (#15103)
IoUring: Disable support for RECVSEND_BUNDLE for now (#15104)
DirContextUtils.addNameServer(...) should just catch Exception internally (#15105)
Use keytool from java.home (#15121)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/Quic 0.0.72.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.72.Final. This is a bug-fix release.

The most important changes are:

Update to netty 4.1.121.Final (#792)
Correctly detect supported namedGroups during initialization (#791)
CEnsure we don't directly close the stream if we receive a STOP_SENDING frame as there might be data that was not read / processed yet. (#790)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.121.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.121.Final. We did a quick followup release as something went wrong during our release of 4.1.120.Final yesterday and so required a different GLIBC version as expected when using our native transport.

The most important changes are:

Epoll.isAvailable() returns false on Ubuntu 20.04/22.04 arch amd64 (#15073)
Fix transport-native-epoll Bundle-SymbolicNames (#15068)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.120.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.120.Final. This is a bug-fix release.

The most important changes are:

Fix flawed termination condition check in HttpPostRequestEncoder#encodeNextChunkUrlEncoded(int) for current InterfaceHttpData (#14799)
Exposed decoderEnforceMaxConsecutiveEmptyDataFrames and decoderEnforceMaxRstFramesPerWindow (#14892)
ThreadExecutorMap must restore old EventExecutor (#14899)
Make Recycler virtual thread friendly (#14892)
Disable sun.misc.Unsafe by default on Java 24+ (#14943)
Adaptive: Correctly enforce leak detection when using AdaptiveByteBufAllocator (#14949)
Add suppressed exception to original cause when calling Future.sync* (#14985)
Add SETTINGS_ENABLE_CONNECT_PROTOCOL to the default HTTP/2 settings (#14995)
Correct computation for suboptimal chunk retirement probability (#15014)
Fix bug in method AdaptivePoolingAllocator.allocateWithoutLock(...) (#15032)
Fix a Bytebuf leak in TcpDnsQueryDecoder (#15035)
SSL: Clear native error if named group is not supported (#15038)
WebSocketClientCompressionHandler shouldn't claim window bits support when jzlib is not available (#15039)
Fix the assignment error of maxQoS parameter in ConnAck Properties (#15040)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.0.Final released

2026-03-25T19:22:27+00:00

After a lot of work and many contributions from our OSS community we are thrilled to finally announce the release of netty 4.2.0.Final! Everyone using netty 4.1.x should be able to upgrade to 4.2.0.Final without any API breakage. The only new requirement is JDK8 or later (and JDK9+ for io_uring) and a more recent GLIBC version when using our native transports.

With the release of netty 4.2.0.Final we will also start to only merge bug-fixes into 4.1, new features will only be merged to 4.2 and main branches. While 4.1.x releases will only receive bug-fixes we will still support it 4.1.x for the time beeing, so projects can take their time to upgrade to 4.2.0.Final. That said as the upgrade should be painless we advice people to do so rather sooner than later.

Please refer to our Migration Guide for all the details related to upgrades. This document also contains sections highling some best practices related to new features introduced in 4.2.

Netty 4.2.0.Final will come with some exciting new features that you can learn more about detail in our Migration Guide.

New Features

This section highlights some of the most exciting features for the end-user.

AdaptiveByteBufAllocator

In Netty 4.1.x the adaptive memory allocator was experimental. We have now made it the new default instead of the pooled allocator.

We believe that most workloads will observe reduced memory usage, with performance that is on par or slightly better than the pooled allocator. The adaptive allocator automatically tunes itself to perform well for the observed workload. It was also designed from the start to work well with virtual threads.

MultiThreadIoEventLoopGroup

In previous versions of netty the EventLoopGroup implementation was tightly coupled to the respective Channel implementation. This made it very hard to extend existing EventLoopGroups to add functionality like instrumentation (especially because you might want to use different transports based on the platform you are running on).

This has changed in 4.2.0, here you will use one EventLoopGroup implementation (MultiThreadIoEventLoopGroup) for all transports. This allows for easier customization of it (think of it like ThreadPoolExecutor that can be extended and customized). To make this possible we extracted the whole IO handling / multiplexing to another class that is injected into the MultiThreadIoEventLoopGroup.

For example:

new EpollEventLoopGroup();

becomes

new MultiThreadIoEventLoopGroup(EpollIoHandler.newFactory();

Other transports follow the same pattern.

MultiThreadIoEventLoopGroup and SingleThreadIoEventLoop provide various methods that can be overridden by the user and so provide the ability to:

get a count of registered Channels / IoHandles
understand how long the io processing vs task processing took
how many Channels / IoHandles were processed per loop run
customize / decorate Promise, Future.

Furthermore, it is now possible to register other things than Channels, which provides a lot of possibilites to re-use netty components and also add support for other IoHandle implementations which does not exists as of today. For example, this could be used to implement file IO with io_uring. For a proof of concept see #14432.

io_uring support

In Netty 4.2.0.Final we have graduated the io_uring transport from incubator, to a fully supported first-class transport module.

As part of this work, we have made numerous refactorings to the Netty transport internals that render the incubator version entirely incompatible. The good news is that netty-transport-native-io_uring is a much superior implementation thanks to these refactorings.

Integrators are encouraged to stop using the incubator module, and instead move to Netty 4.2.0.Final for its superior io_uring integration. Doing so will unfortunately require code changes. Please refer to the Migration Guide.

With the integration of io_uring into 4.2.0.Final we also will not continue to ship io_uring support for 4.1 (as part of the incubator project). Special thanks to @axboe for all the feedback and help and quickly reacting to feedback that caused changes to io_uring itself.

ManualIoEventLoop

In the past people often asked if it would be possible to "drive" the EventLoop manual, which basically means to own the Thread that drives the EventLoop itself and decide by themselves when io / tasks are processed. This was not possible in netty 4.1 due of the tight coupling of EventLoopGroups and Channels. As this is not the case anymore with 4.2.0 we did revisit this feature request and were able to provide an implementation which does exactly what people have asked for.

An example of its usage would be:

    Thread currentThread = Thread.currentThread();
    ManualIoEventLoop eventLoop = new ManualIoEventLoop(currentThread, NioIoHandler.newFactory());
    ServerBootstrap bootstrap = new ServerBootstrap();
    Channel channel = bootstrap.channel(NioServerSocketChannel.class)
            .handler(serverHandler).bind(0);
    while (!eventLoop.isTerminated()) {
        doSomeworkOtherWork();
        eventLoop.runNow();
    }

ManualIoEventLoop exposed various methods which allows to either run everything that is ready yet, or block until there is something ready. Please refer to the javadocs for more details. That said this is an advanced feature and should only be used if there is a good use-case for it as care needs to be taked to process IO / tasks in a timely manner.

General changes

The most important changes in this release (compared to the previous release candidate) are:

Add suppressed exception to original cause when calling Future.sync* (#14898)
IoUring: Guard against possible crash when resources are accessed after closure (#14904)
IoUring: Correctly calculate ioPrio when using multishot accept (#14907)
IoUring: Correctly handle late removal of registration for multishot completions (#14913)
IoUring: Use correct native jni types in function definition (#14914)
IoUring: Expand buffer ring on the fly (#14916)
IoUring: Fix AssertionError caused by racing cancellation and completion (#14921)
Fix channel de-registering executor cache clear bug (#14924)
Fix allocateUninitializedArray invocation via MH (#14931)
IoUring: Ensure close completes before closing the eventloop group (#14933)
IoUring: Ensure we guard against segfaults in all cases (#14938)
Adaptive: Correctly enforce leak detection when using AdaptiveByteBufAllocator (#14946)
IoUring: Allow to use io_uring without sun.misc.Unsafe (#14962)
IoUring: Correctly memset struct io_uring (#14968)
Build Netty 4.2 on CentOS 7 (#14973)
Disable sun.misc.Unsafe by default on Java 24+ (#14975)
Allow delayed set of owningThread in ManualIoEventLoop (#14976)
Fix support for DH_anon and ECDH_anon authentication methods (#14977)
HTTP2: Allow to manually manage window update frames when using Http2StreamChannel (#14980)
Fix timeout when auto read is disabled late in io_uring (#14989)

For all the changes please vision our issue-tracker.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test all the alpha, beta and release-canidates of netty 4.2.0. Without the feedback it would have been impossible to complete this release.

Netty/Incubator/Codec/HTTP3 0.0.29.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-http3 0.0.29.Final. This release update its netty-incubator-codec-quic version to 0.0.71.Final which includes a CVE fix so we recommend everyone to upgrade. Beside this it also contains various other bugfies.

The most important changes are:

Add getter for Http3ErrorCode.code (#297)
Let header validator find host header field when :authority pseudo-header field is missing (#324)
Update to netty 4.1.118.Final (#325)
Update to netty-incubator-codec-quic 0.0.71.Final (#327)

For more details related to this release see our bug-tracker.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/Quic 0.0.71.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.71.Final. This release fixes (CVE-2025-29908) and so you should consider upgrading as soon as possible.

The most important changes are:

QUIC hash collision DoS attack (#CVE-2025-29908)
Update to netty 4.1.118.Final (#776)
Support cancellation of various outbound operations (#779)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/OHTTP 0.0.18.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-ohttp 0.0.18.Final. This release is a bug-fix release.

The most important changes are:

Use BoringSSL master branch (#90)
Add method to export AEAD param (#95)
Update to netty 4.1.118.Final (#96)
Allow to specific the maximum chunk size that is enforced by the OHttpVersionChunkDraft (#97)

For more details related to this release see our bug-tracker.

Netty 4.2.0.RC4 released

2026-03-25T19:22:27+00:00

We are happy to announce the release of the third release candidate for the upcoming netty version 4.2.0. Everyone using netty 4.1.x should be able to upgrade to 4.2.0.RC4 without any API breakage. The only new requirement is JDK8 or later.

We encourage users of netty 4.1.x to try out this alpha release and so provide feedback if any breakage is noticed. This will help us to be aware of any problems early in the release cycle. That said, be aware that this is only an release candidate and so shouldn't be considered for production usage yet.

Netty 4.2.0 will come with some exciting new features that you can learn more about in the announcement of netty 4.2.0.Alpha1.

The most important changes in this release are:

IoUring: Support for IORING_SETUP_CQSIZE (#14793)
Remove pkitesting from netty-all (#14798)
IoUring: Use buffer ring for all reads when configured. (#14804)
IoUring: Add code to support multishot in general and use ACCEPT_MULTISHOT (#14807)
IoUring: Add support for IORING_RECV_MULTISHOT (#14818)
IoUring: Fix IoBufferRing implementation (#14827)
Fix NPE when upgrade message fails to aggregate (#14831)
Bump BlockHound version to 1.0.11.RELEASE (#14834)
SslHandler: Fix possible NPE when executor is used for delegating (#14833)
IoUring: Fix rearm logic (#14836)
IoUring: Refill buffer ring more eagerly (#14842)
Convenient API for specifying SNI hostname (#14849)
IoUring: Use IORING_POLL_ADD_MULTI when possible (#14845)
Add QueryStringDecoder option to leave '+' alone (#14857)
IoUring: Correctly handle pollIn notifications if there is no read pending (#14859)
IoUring: Select buffer ring once (#14858)
IoUring: Correctly cancel pollin and read when ChannelConfig.setAutoRead(false) (#14860)
Use initialized BouncyCastle providers when available (#14862)
IoUring: Retry buffer ring based ready directly once we receive a ENOBUFS (#14866)
IoUring: Add support for recv bundles (#14840)
IoUring: Correctly retrieves the cqe capacity (#14871)
Fix flawed termination condition check in HttpPostRequestEncoder (#14870)
IoUring: Guard against corrupted state when we fail to allocate for the buffer ring (#14869)
IoUring: Correctly drain all IO events before shutdown the EventLoop and so not accepted any more tasks to be scheduled. (#14877)
IoUring: Guard against reading to fast when using a buffer ring (#14873)
Allow to specify parent IoEventLoopGroup when constructing ManualIoEventLoop (#14889)
IoUring: Fix IoUringBufferRing (#14890)
ThreadExecutorMap.currentExecutor() should work when using a ManualIoEventLoop (#14888)
IoUring: Optimize CompletionBuffer.processOneNow(...) (#14894)
Exposed decoderEnforceMaxConsecutiveEmptyDataFrames and decoderEnforceMaxRstFramesPerWindow for 4.2 (#14897)
IoUring: Correctly calculate ioPrio / recvFlags when using multishot recv (#14896)
ThreadExecutorMap must restore old EventExecutor (#14895)

For all the changes please vision our issue-tracker.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test 4.2.0.* so far.

Netty 4.1.119.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.119.Final. This is a bug-fix release.

The most important changes are:

Replace SSL assertion with explicit record length check (#14810)
Fix NPE when upgrade message fails to aggregate (#14816)
SslHandler: Fix possible NPE when executor is used for delegating (#14830)
Consistently add channel info in HTTP/2 logs (#14829)
Add QueryStringDecoder option to leave '+' alone (#14850)
Use initialized BouncyCastle providers when available (#14855)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.0.RC3 released

2026-03-25T19:22:27+00:00

We are happy to announce the release of the third release canidate for the upcoming netty version 4.2.0. Everyone using netty 4.1.x should be able to upgrade to 4.2.0.RC3 without any API breakage. The only new requirement is JDK8 or later.

We encourage users of netty 4.1.x to try out this alpha release and so provide feedback if any breakage is noticed. This will help us to be aware of any problems early in the release cycle. That said, be aware that this is only an release canidate and so shouldn't be considered for production usage yet.

Netty 4.2.0 will come with some exciting new features that you can learn more about in the announcement of netty 4.2.0.Alpha1.

The most important changes in this release are:

IoUring: try to enable IORING_SETUP_SUBMIT_ALL when supported by the running system (#14677)
IoUring: Create ring with IORING_SETUP_SINGLE_ISSUER and IORING_SETUP_DEFER_TASKRUN to reduce overhead (#14699)
IoUring: Only execute write related completion inline (#14704)
IoUring: Fix SubmissionQueue.addTimeout(...) and SubmissionQueue.addLinkTimeout(...) (#14712)
IoHandler: Introduce IoExecutor and pass it to IoHandlerFactory.newHandler(...) (#14701)
IoUring: Use IORING_REGISTER_RING_FDS when possible (#14709)
IoUring: Log what features are supported (#14719)
IoUring: Correctly handle submissions if the kernel does not support IORING_SETUP_SUBMIT_ALL (#14718)
IoUring: Rename IoUringIoHandlerConfiguration to IoUringIoHandlerConfig (#14726)
Add a property to control default endpoint verification (#14731)
Allocate bytebuf without magazine lock when threads get collisions (#14729)
Upgrade protobuf 3.16.3 -> 3.25.5 (#14736)
Make StreamBufferingEncoder not send header frame with priority by default (#14735)
IOUring: Add supported for provided buffers (#14690)
Notify event loop termination future of unexpected exceptions (#14737)
IoRegistration: Remove usage of Future from external API and allow for wrapping (#14744)
Rename IoExecutor to ThreadAwareExecutor and move to concurrent package (#14747)
Add support for generating ML-DSA certs with CertificateBuilder (#14741)
Fix AccessControlException in GlobalEventExecutor (#14754)
Fix possible buffer leak when stream can't be mapped (#14755)
Preserve optionality of dependencies in netty-all (#14751)
IoEventLoop*: Move default methods to IoEventLoopGroup (#14764)
Remove IoUringChannelOption.IOSQE_ASYNC (#14765)
Remove IoUringChannelOption.POLL_FIRST (#14763)
IoUring: Handle read errors because of no space in the buffer ring as no op (#14767)
IoUring: Use IORING_RECVSEND_POLL_FIRST even when using buffer ring. (#14766)
Revert new constructor of DefaultPromise (#14771)
IoUring: IoUringBufferRing group ids should allow value of 0 (#14776)
Reduce pipeline stack depth and improve performance (#14705)
Introduce ManualIoEventLoop that allows the user to keep control over the EventLoop processing (#14749)
IoUring: Add support for Incremental provided buffer consumption (#14783)
AdaptivePoolingAllocator: Round chunk sizes up to MIN_CHUNK_SIZE units and reduce chunk release frequency (#14781)
IoUring: Make buffer ring selection more flexible (#14786)
IoUring: Improve our implementation of the IoUringBufferRing (#14788)
IoUring: Lazy fill IoBufferRing (#14789)
Upgrade netty-tcnative to 2.0.70.Final (#14792)

For all the changes please vision our issue-tracker.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test 4.2.0.* so far.

Netty 4.1.118.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.118.Final. This is a bug-fix release but also fixes a (critical CVE) in our SSL implementation. Please upgrade as soon as possible if you use our native SSL implementation.

The most important changes are:

SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970)
Denial of Service attack on windows app using Netty, again (CVE-2025-25193)
Upgrade netty-tcnative to 2.0.70.Final (#14790)
Fix recycling in CodecOutputList (#14706)
Allocate bytebuf without magazine lock when threads get collisions (#14594)
Make StreamBufferingEncoder not send header frame with priority by default (#14732)
Notify event loop termination future of unexpected exceptions (#14734)
KQueueEventLoop leaks memory on shutdown (#14745)
Fix AccessControlException in GlobalEventExecutor (#14743)
Fix possible buffer leak when stream can't be mapped (#14746)
AdaptivePoolingAllocator: Round chunk sizes up to MIN_CHUNK_SIZE units and reduce chunk release frequency (#14763)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.0.RC2 released

2026-03-25T19:22:27+00:00

We are happy to announce the release of the second release canidate for the upcoming netty version 4.2.0. Everyone using netty 4.1.x should be able to upgrade to 4.2.0.Alpha4 without any API breakage. The only new requirement is JDK8 or later.

We encourage users of netty 4.1.x to try out this alpha release and so provide feedback if any breakage is noticed. This will help us to be aware of any problems early in the release cycle. That said, be aware that this is only an release canidate and so shouldn't be considered for production usage yet.

Netty 4.2.0 will come with some exciting new features that you can learn more about in the announcement of netty 4.2.0.Alpha1.

The most important changes in this release are:

IoUring: IoUringRegistration.cancel() didn't remove registration when called only once (#14536)
IoUring: Use IORING_RECVSEND_POLL_FIRST when we are sure there is no more data on the socket (#14552)
Spdy: Add UnknownFrame parsing support for SpdyFrameCodec (#14561)
Adaptive: Correctly restore allocatedBytes value on failure (#14577)
Add BlockHound exceptions for AdaptivePoolingAllocator (#14564)
Adapt: Only add Chunk to central Queue if unused (#14580)
Adapt: Don't fail when we run on a host with 1 core (#14582)
Timer: Add callback users can override to cleanup on cancellation (#14571)
Adapt: Ensure Chunks from the central Queue are re-used even if there are Magazine local cached Chunks (#14581)
Allow PcapWriteHandler to output PCAP files larger than 2GB (#14587)
IoUring: Allow to configure if POLLIN should be used or not (#14605)
Limit the task run per EventLoop tick via a timeout (#14557)
IoUring: Make use of IORING_CQE_F_SOCK_NONEMPTY and IORING_ACCEPT_DONT_WAIT (#14610)
IoUring: Also make use of IORING_RECVSEND_POLL_FIRST for accept (#14617)
Support BouncyCastle FIPS for reading PEM files (#14620)
Fix classloader leaks in GlobalEventExecutor (#14622)
Dns: Correctly encode DnsPtrRecord (#14630)
FWD: Make DefaultResourceLeak more resilient against OOM (#14638)
SslHandler: Ensure buffers are never leaked when wrap(...) produce SSLException (#14651)
Provides Brotli settings without com.aayushatharva.brotli4j dependency (#14655)
OpenSslSession: Add support to defensively check for peer certs (#14653)
Adaptive: Only use ThreadLocal if called from FastThreadLocalThread in case of temporary byte[] allocation (#14625)
Correctly handle comments appended to nameserver declarations (#14663)
IoUring: Add IoUringChannelOption.IOSQE_ASYNC (#14633)
IoUring: Release IovArray on submit failure (#14667)
IoUring: Correctly handle submission failures when using MsgHdrMemoryArray (#14666)
Revert "IoUring: Remove delayed close logic as its not needed (#14665)
IoUring: Keep on reading data until nothing is left to read on a socket (#14668)
IoUring: Log submission failures via tracing level as these are expected (#14671)
IoUring: Use IORING_ACCEPT_POLL_FIRST instead of IORING_RECVSEND_POLL_FIRST (#14669)
IoUring: Add support for IORING_REGISTER_IOWQ_MAX_WORKERS (#14650)
IoUring: Correctly handle IORING_CQE_F_SOCK_NONEMPTY for accepts (#14682)
IoUring: Only use IORING_ACCEPT_POLL_FIRST and IORING_ACCEPT_DONTWAIT if supported by kernel (#14680)
IoUring: Check if IORING_RECVSEND_POLL_FIRST is supported before using it (#14683)
IoUring: Force submit and instantly running completions when Channel becomes unwritable (#14693)
IoUring: Submit after completion queue was processed (#14696)

For all the changes please vision our issue-tracker.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test 4.2.0.* so far.

Netty 4.1.117.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.117.Final. This is a bug-fix release.

The most important changes are:

Fix classloader leaks in GlobalEventExecuto (#14616)
Support BouncyCastle FIPS for reading PEM files (#14618)
Dns: Correctly encode DnsPtrRecord (#14628)
Provides Brotli settings without com.aayushatharva.brotli4j dependency (#14629)
Make DefaultResourceLeak more resilient against OOM (#14642)
OpenSslSession: Add support to defensively check for peer certs (#14641)
Reentrant close in EmbeddedChannel (#14642)
SslHandler: Ensure buffers are never leaked when wrap(...) produce SSLException (#14647)
Adaptive: Only use ThreadLocal if called from FastThreadLocalThread in case of temporary byte[] allocation (#14656)
Correcly handle comments appended to nameserver declarations (#14658)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Transport/io_uring 0.0.26.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of Netty/Incubator/Transport/io_uring 0.0.26.Final. This release is a bug fix release.

The most important changes are:

Catch completion handler errors (#244)
Update to netty 4.1.116.Final (#262)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/Quic 0.0.70.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.70.Final. While containing bug-fixes it also comes with two new features that might come in handy for more advanced use cases.

The most important changes are:

Ensure native library is loaded before making calls in the static block (#760)
Allow the QuicConnectionIdGenerator also take the source connection id into account (#766)
New BoringSSL context option - SSL_CTX_set1_sigalgs (#765)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.116.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.116.Final. This is a bug-fix release.

The most important changes are:

PcapWriteHandler no longer ignores writePcapGlobalHeader (#14477)
Allow PcapWriteHandler to output PCAP files larger than 2GB (#14478)
Fix bugs in BoundedInputStream (#14480)
AdaptiveByteBufAllocator will not use threadlocal magazine if FastThreadLocalThread.willCleanupFastThreadLocals() returns false (#14486)
Fix HTTP header validation bug (#14492)
Add range check for AdaptivePoolingAllocator.CENTRAL_QUEUE_CAPACITY and MAGAZINE_BUFFER_QUEUE_CAPACITY (#14493)
Fix possible race condition in method AdaptivePoolingAllocator.offerToQueue(...) (#14495)
Make sure the sentinel Magazine.MAGAZINE_FREED not be replaced (#14502)
Decrease usedMemory of magazine when the chunk get deallocate (#14508)
Only try to use Zstd and Brotli if we can load the native libs. (#14519)
AdaptiveByteBufAllocator: Correctly manage used memory strategy in all cases (#14524)
Bump BlockHound version to 1.0.10.RELEASE (#14558)
Add details to TooLongFrameException message (#14562)
Adapt: Only add Chunk to central Queue if unused (#14583)
Adapt: Don't fail when we run on a host with 1 core (#14584)
Adapt: Ensure Chunks from the central Queue are re-used even if there are Magazine local cached Chunks (#14586)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.0.RC1 released

2026-03-25T19:22:27+00:00

We are happy to announce the release of the first release canidate for the upcoming netty version 4.2.0. Everyone using netty 4.1.x should be able to upgrade to 4.2.0.Alpha4 without any API breakage. The only new requirement is JDK8 or later.

We encourage users of netty 4.1.x to try out this alpha release and so provide feedback if any breakage is noticed. This will help us to be aware of any problems early in the release cycle. That said, be aware that this is only an release canidate and so shouldn't be considered for production usage yet.

Netty 4.2.0 will come with some exciting new features that you can learn more about in the announcement of netty 4.2.0.Alpha1.

The most important changes in this release are:

Add a module for generating X.509 certificates for testing (#14263)
Include details on why it was not possible to configure accepted issuers in the SSLException (#14438)
Verify default named groups before using them with native SSL implementation (#14441)
Correctly detect if KeyManager is not supported by OpenSSL version (#14442)
Allow to set used named groups per OpenSslContext (#14443)
Preserve ordering of default named groups during conversation (#14449)
Specialize Adaptive's allocator Recycler based on magazine's owner (#14454)
PcapWriteHandler no longer ignores writePcapGlobalHeader (#14484)
IoUring: Add FileRegion support (#14487)
AdaptiveByteBufAllocator will not use threadlocal magazine if FastThreadLocalThread.willCleanupFastThreadLocals() returns false (#14490)
Add range check for AdaptivePoolingAllocator.CENTRAL_QUEUE_CAPACITY and MAGAZINE_BUFFER_QUEUE_CAPACITY (#14497)
Fix HTTP header validation bug (#14500)
Make sure the sentinel Magazine.MAGAZINE_FREED not be replaced (#14503)
Narrow the lock scope of AdaptivePoolingAllocator.magazineExpandLock (#14504)
IoUring: Fix AssertionError when closing IoUringServerChannel twice (#14506)
IoUring: Correcly handle double closure and always cancel submitted IO ops on deregistration (#14510)
fix: Don't make MqttPublishMessage ensure payload accessibility (#14512)
Decrease usedMemory of magazine when the chunk get deallocated or moved to central queue (#14515)
AdaptiveByteBufAllocator: Correctly manage used memory strategy in all cases (#14516)
Use StandardCompressionOptions in all constructors of HttpContentCompressor (#14517)
Only try to use Zstd and Brotli if we can load the native libs. (#14520)
IoUring: Refactor IoUringIoOps to better match the underlying io_uring_sqe (#14521)
IoUring: Ensure buffers don't leak if submission fails (#14525)
IoUring: Correct update internal state for cancelled operations (#14529)
IoUring: Correctly handle cancelletion of close and connect (#14531)
IoUring: Always cancel all ops on deregistration / close (#14537)
Deprecate ChannelPipeline.add*(EventExecutorGroup....) methods (#14538)
IoUring: IoUringHandler must not manually cancel IoUringHandle on teardown (#14539)
Implement 'inEventLoop' for UnorderedThreadPoolEventExecutor and deprecate it (#14544)
IoUring: Correctly handle accept submit failures (#14547)
IoUring: Make static methods of IoUringIoOps package-private (#14551)

For all the changes please vision our issue-tracker.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test 4.2.0.* so far.

Netty/Incubator/Codec/Quic 0.0.69.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.69.Final.

The most important changes are:

Use BoringSSL master branch (#752)
Allow to configure used named groups via -Djdk.tls.namedGroup (#754)
Allow to configure groups via BoringSSLContextOption (#755)
Upgrade to netty 4.1.115.Final (#757)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.1.115.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.115.Final. This is a bug-fix release but also include a fix for (CVE-2024-47535) which we rate as very low as the attacker needs to have access to the local filesystem with the right permissions.

The most important changes are:

Allow MessageToMessageDecoder to take care of reading more data when needed (#14372)
Fix SSL session resumption with ClientAuth.OPTIONAL and add tests with session tickets (#14404)
Fix incorrect cast in NioDomainSocketChannel.parent() (#14409)
Fix bug where SslHandler may stall after TLSv1.3 handshake with delegate tasks (#14411)
AdaptiveByteBufAllocator: Make pooling of AdaptiveByteBuf magazine local (#14414)
Specialize Adaptive's allocator Recycler based on magazine's owner (#14421)
Fix epoll_wait retry loop (#14425)
Log / include the correct error during handshake failure (#14428)
Convey autoAckPing in http2 decoder constructor chain (#14429)
Allow to set used named groups per OpenSslContext (#14433)
Verify default named groups before using them with native SSL implementation (#14434)
Include details on why it was not possible to configure accepted issuers in the SSLException (#14435)
Correctly detect if KeyManager is not supported by OpenSSL version (#14437)
Preserve ordering of default named groups during conversation (#14447)
Denial of Service attack on windows app using netty (CVE-2024-47535)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty 4.2.0.Beta1 released

2026-03-25T19:22:27+00:00

We are happy to announce the release of the first beta for the upcoming netty version 4.2.0. Everyone using netty 4.1.x should be able to upgrade to 4.2.0.Alpha4 without any API breakage. The only new requirement is JDK8 or later.

We encourage users of netty 4.1.x to try out this alpha release and so provide feedback if any breakage is noticed. This will help us to be aware of any problems early in the release cycle. That said, be aware that this is only an alpha release and so shouldn't be considered for production usage.

Netty 4.2.0 will come with some exciting new features that you can learn more about in the announcement of netty 4.2.0.Alpha1.

The most important changes in this release are:

Fix SSL session resumption with ClientAuth.OPTIONAL and add tests with session tickets (#14404)
Fix incorrect cast in NioDomainSocketChannel.parent() (#14409)
Fix bug where SslHandler may stall after TLSv1.3 handshake with delegate tasks (#14411)
Log / include the correct error during handshake failure (#14428)
Update to netty-tcnative 2.0.69.Final (#14422)
Fix epoll_wait retry loop (#14425)
Allow MessageToMessageDecoder to take care of reading more data when needed (#14372)

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test 4.2.0.Alpha* so far.

Netty/Incubator/Codec/OHTTP 0.0.17.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-ohttp 0.0.17.Final. This release is a bug-fix release.

The most important changes are:

Ensure we will call read() if nothing was decoded and AUTO_READ is not used (#88)

For more details related to this release see our bug-tracker.

Netty 4.2.0.Alpha5 released

2026-03-25T19:22:27+00:00

We are happy to announce the release of the fifth alpha for the upcoming netty version 4.2.0. This will be the last alpha release. Everyone using netty 4.1.x should be able to upgrade to 4.2.0.Alpha4 without any API breakage. The only new requirement is JDK8 or later.

We encourage users of netty 4.1.x to try out this alpha release and so provide feedback if any breakage is noticed. This will help us to be aware of any problems early in the release cycle. That said, be aware that this is only an alpha release and so shouldn't be considered for production usage.

Netty 4.2.0 will come with some exciting new features that you can learn more about in the announcement of netty 4.2.0.Alpha1.

The most important changes in this release are:

Only add Magazine to Set if we can ensure its removed again (#14286)
Ensure Chunk will not leak if init of AdaptiveByteBuf fails for whatever reason (#14288)
Correctly release one-off allocated chunks (#14298)
Ensure pooled memory is released when AdaptivePoolingAllocator is GC'ed (#14300)
Slices / duplicates of AdaptiveByteBuf must not escape the rootParent (#14301)
Fix sizeBucket bug in AdaptivePoolingAllocator (#14306)
Switch to AdaptiveByteBufAllocator by default (#14271)
AdaptiveByteBufAllocator: More strict reference counting for chunks (#14323)
AdaptiveByteBufAllocator: Reduce memory fragmentation (#14341)
Allow to reuse more then one session per host / port mapping (#14360)
Ensure writes will not fail when triggered after receiving UpgradeEvent.UPGRADE_SUCCESSFUL (#14363)
Refactor DnsNameResolver to be able to use different strategies when it comes to creating Channels for queries (#14382)
Make netty-codec 4.2 Maven artifact behave like 4.1 regarding its dependencies (#14386)
Add assert and restore reference count when releasing Chunks (#14391)
Ensure freeResourcesNow(...) can only be called once and so guard against undefined behavior (#14390)
Fix possible assert error if read is triggered before registration is complete or after deregister completes (#14395)

For more details please visit our bug tracker

Important

This release changes the default ByteBufAllocator from PooledByteBufAllocator to AdaptiveByteBufAllocator. This should reduce memory overhead in general. If you want to use PooledByteBufAllocator you should explicit enable it.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Beside this we also would like to thank everyone who took the time to test 4.2.0.Alpha* so far.

Netty 4.1.114.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty 4.1.114.Final. This is a bug-fix release.

The most important changes are:

Validate HTTP Method (#14280)
Release AdaptiveByteBuf when ownership could not be transfered. (#14285)
Make arenas reuse their last chunk more aggressively (#14291)
Only add Magazine to Set if we can ensure its removed again (#14292)
Ensure Chunk will not leak if init of AdaptiveByteBuf fails for whatever reason (#14295)
Correctly release one-off allocated chunks (#14302)
Ensure pooled memory is released when AdaptivePoolingAllocator is GC'ed (#14304)
Slices / duplicates of AdaptiveByteBuf must not escape the rootParent (#14310)
Fix sizeBucket bug in AdaptivePoolingAllocator (#14311)
AdaptiveByteBufAllocator: More strict reference counting for chunks (#14322)
Ensure we not store the DnsQueryContext for later removal when we couldnt obtain a query id (#14326)
Reduce memory fragmentation (#14333)
Properly free magazine chunks and avoid orphaned magazines (#14334)
Magazines must be freed under the expand lock (#14336)
Release message before failing promise when multiple requests are written while upgrade is in progress. (#14342)
Allow to reuse more then one session per host / port mapping (#14356)
Ensure writes will not fail when triggered after receiving UpgradeEvent.UPGRADE_SUCCESSFUL (#14362)
Refactor DnsNameResolver to be able to use different strategies when it comes to creating Channels for queries. (#14374)
DnsNameResolver: allow users to skip bind() during bootstrap (#14375)
DnsResolverBuilder methods should make it clear that these are for DatagramChannel (#14379)

For more details please visit our bug tracker

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.

Netty/Incubator/Codec/Quic 0.0.68.Final released

2026-03-25T19:22:27+00:00

We are happy to announce the release of netty-incubator-codec-quic 0.0.68.Final. This is a bug-fix release.

The most important changes are:

WritabilityChanged event is triggered with wrong capacity #748 (#748)
Upgrade to netty 4.1.113.Final (#746)

For more details related to this release see our bug-tracker.

For more details about this codec in general please read our initial announcement.

Thank You

Every idea and bug-report counts, and so we thought it is worth mentioning those who helped in this area.

Please report an unintended omission.