Repository navigation
[fix][sec][branch-4.2] Upgrade AsyncHttpClient to 3.0.14 and Netty to 4.2.19 - #27121
Technoboy- wants to merge 1 commit into
Conversation
Backport the HTTP client security update to the branch-4.2 codebase. Upgrade AsyncHttpClient to 3.0.14, Netty to 4.2.19.Final, and Netty Reactive Streams to 2.0.20. Adapt Duration-based timeouts, HTTP/2 runtime dependencies, and io_uring transport initialization and channel selection. Preserve the existing Java 17 client target, shared Timer/EventLoop/DNS resources, User-Agent descriptions, and no-argument transport helpers. Adapt the HTTPS lookup regression to the shared resource constructor. Declare netty-common and netty-buffer as provided dependencies in the message crypto module for FastThreadLocal and compression codec APIs. Include the upstream per-message flow-control handler and regressions so Netty 4.2 does not break Broker auto-read throttling. Update the server and shell distribution license entries for the new dependencies. Validation: fresh selected reactor clean install passed (153 passed, 1 io_uring skip); all three shaded client artifacts built and started on Java 17; Linux ARM64 Epoll and flow-control tests passed. Full cluster E2E was not run. (cherry picked from commit 0008876)
There was a problem hiding this comment.
branch-4.2 AsyncHttpClient should be kept on 2.x and Netty on 4.1.x.
AsyncHttpClient 2.16.1 most likely already contains the fixes.
Netty 4.1.139.Final contains the same fixes as 4.2.19.Final.
|
Most likely it would be possible to upgrade and it's necessary unless CVE fixes get delivered. For upgrading, it would be useful to consider the consequences for users. There could be a broader impact on dependencies in the upgrade, please see #25023. |
Do you read the cve ? |
Yes, there isn't a 2.x fix available in AsyncHttpClient. It might be fine to upgrade since AsyncHttpClient/async-http-client#2190 was resolved in 3.x which was a blocker before. |
|
Another fixed issue in AsyncHttpClient is AsyncHttpClient/async-http-client#2191 which could make this change feasible together with AsyncHttpClient/async-http-client#2190 being addressed. |
|
@Technoboy- My remaining concern is BookKeeper's 4.2.x support. Please check apache/bookkeeper#4744 for the changes that were made in BK for the Netty 4.2.x upgrade. |
Motivation
For fixing the "CVE-2026-107227"
Some implementation like : MultiThreadIoEventLoopGroup to replace IOUringEventLoopGroup, PulsarFlowControlHandler are copyed from master branch.