Visitar URL original
[SPARK-60022][BUILD] Upgrade Netty to 4.2.19.Final by dongjoon-hyun · Pull Request #59266 · apache/spark · GitHub
Skip to content

[SPARK-60022][BUILD] Upgrade Netty to 4.2.19.Final - #59266

Closed
dongjoon-hyun wants to merge 1 commit into
apache:masterfrom
dongjoon-hyun:SPARK-60022
Closed

dongjoon-hyun wants to merge 1 commit into
apache:masterfrom
dongjoon-hyun:SPARK-60022

Conversation

@dongjoon-hyun

Copy link
Copy Markdown
Member

What changes were proposed in this pull request?

This PR aims to upgrade Netty to 4.2.19.Final.

Why are the changes needed?

To bring the latest security and bug fixes:

This release contains 16 security fixes, including the following in the modules used by Spark:

  • Improper CRLF neutralization and request/response smuggling in io.netty:netty-codec-http
  • Origin validation error and unbounded resource consumption in io.netty:netty-codec-http
  • Unbounded resource consumption in io.netty:netty-codec-http2, io.netty:netty-codec-base, and io.netty:netty-codec-dns
  • SNI routing bypass and improper access control in io.netty:netty-handler
  • Input misinterpretation in io.netty:netty-codec-socks

It also contains the following bug fixes, among others:

  • HTTP/2: Remove failed SETTINGS from ACK queue
  • HTTP/2: Reserve promised stream before running the request verifier
  • Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code
  • Guard against out-of-bounds reads when parsing ClientHello SNI extension
  • Release Channel when SimpleChannelPool acquire is cancelled
  • Make IoEventLoopGroup.isCompatible/isIoType side-effect free
  • HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter

Does this PR introduce any user-facing change?

No.

How was this patch tested?

Pass the CIs.

Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Opus 5.5

@dongjoon-hyun

Copy link
Copy Markdown
Member Author

This is still a Draft since this is released newly on 2026-10-06.

@dongjoon-hyun

Copy link
Copy Markdown
Member Author

Thank you, @LuciferYang .

@dongjoon-hyun
dongjoon-hyun marked this pull request as ready for review October 7, 2026 23:17
@dongjoon-hyun

Copy link
Copy Markdown
Member Author

Merge Summary:

Posted by merge_spark_pr.py

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants