HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding - #17089
Merged
chrisvest merged 2 commits intoJul 31, 2026
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
…header encoding Motivation: Same class of bug as the SslHandler leak fixed in netty#17059: the header buffer allocated in encodeInitHttpMessage()/encodeFullHttpMessage() is leaked if encodeHeaders() throws (typically an OutOfMemoryError) before the buffer is handed off to the out list. netty#6729 reported the same symptom in 2017 but it could not be reproduced on demand and was closed without a fix. Modification: Guard the header buffer with a success/handed-off flag and release it in a finally unless ownership was transferred. In encodeFullHttpMessage() the flag is set immediately before encodeByteBufHttpContent() so the chunked path, where buf is already added to out before encodeChunkedHttpContent() can throw, does not double-release. Add a test using a tracking allocator that injects an OutOfMemoryError during header encoding. Result: No buffer leak when a Throwable is thrown mid header encoding. The normal path is unchanged.
…uring header encoding Motivation: Same class of bug as the SslHandler leak fixed in netty#17059: in writeHeadersInternal(), writePushPromise() and writeContinuationFrames() the retained header fragment (and the reused CONTINUATION frame-header buffer) is leaked if a frame-header allocation throws (typically an OutOfMemoryError) after the fragment has been sliced off the header block. Modification: Hoist fragment to method scope, null it right after ctx.write(fragment, ...), and release it in a finally if non-null. writeContinuationFrames() additionally guards the reused frame-header buffer with a per-fragment flag so a failed reallocation does not leak or double-release. Add a test using a tracking allocator that injects an OutOfMemoryError on the frame-header allocation. Result: No buffer leak when a Throwable is thrown mid header encoding. The normal path is unchanged.
normanmaurer
approved these changes
Jul 10, 2026
chrisvest
approved these changes
Jul 31, 2026
Copy link
Copy Markdown
Member
|
Thanks! |
Sorry, something went wrong.
This was referenced Jul 31, 2026
normanmaurer
added a commit
that referenced
this pull request
Aug 3, 2026
…uffer leak when a `Throwable` is thrown during header encoding (#17178) Auto-port of #17089 to 4.1 Cherry-picked commit: 10e24f9 --- ### Motivation Fixes #17088. Same class of bug as the `SslHandler` leak fixed in #17059: a header buffer is allocated, then a `Throwable` (typically `OutOfMemoryError`) is thrown before the buffer is handed off, leaving it unreleased. #6729 reported the exact symptom on `HttpObjectEncoder.encodeHeaders` back in 2017 but couldn't be reproduced on demand and was closed; the root cause was never fixed. Affected paths: - HTTP/1 — `encodeInitHttpMessage()` and `encodeFullHttpMessage()` in `HttpObjectEncoder`: `buf` from `ctx.alloc().buffer(...)` leaks if `encodeHeaders()` throws before it is added to `out`. - HTTP/2 — `writeHeadersInternal()`, `writePushPromise()` and `writeContinuationFrames()` in `DefaultHttp2FrameWriter`: the retained `fragment` / frame-header buffer leaks if a later allocation throws after the fragment is sliced off the header block. With pooled direct buffers this leaks off-heap memory the GC cannot reclaim, so repeated OOME on these paths ends in `OutOfDirectMemoryError` / process death. ### Modification - `HttpObjectEncoder`: guard the header buffer with a success/handed-off flag and release it in a `finally` unless ownership was transferred. In `encodeFullHttpMessage()` the flag is set immediately before `encodeByteBufHttpContent()` so the chunked path — where `buf` is already added to `out` before `encodeChunkedHttpContent()` can throw — does not double-release. - `DefaultHttp2FrameWriter`: hoist `fragment` to method scope, null it right after `ctx.write(fragment, ...)`, and release it in `finally` if non-null. `writeContinuationFrames()` additionally guards the reused frame-header buffer with a per-fragment flag. - Add tests to both modules using a tracking allocator that injects an `OutOfMemoryError` on a targeted allocation, asserting every tracked buffer reaches `refCnt() == 0` after the failure. ### Result No buffer leak when a `Throwable` is thrown mid header encoding. The normal path is unchanged. Measured with the tracking allocator (each OOME on these paths leaks exactly one header buffer, so the leak grows linearly with the number of affected requests): | path | leak / request | before | after | |---|---|---|---| | `HttpObjectEncoder` init / full | 256 B | `refCnt == 1` | `0` | | Http2 `writeHeaders` / `writePushPromise` | 256 B | `refCnt == 1` | `0` | | Http2 `writeContinuationFrames` (large headers) | 64 KiB | `refCnt == 1` | `0` | At scale on the 256 B paths that is ~244 MiB leaked per 1M affected requests; on the CONTINUATION path (large headers) ~61 GiB per 1M. After the fix the leak is `0` regardless of request count. --------- Co-authored-by: HwangRock <157935545+HwangRock@users.noreply.github.com> Co-authored-by: Norman Maurer <norman_maurer@apple.com>
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
Aug 9, 2026
…l [skip ci] Bumps [io.netty:netty-all](https://github.com/netty/netty) from 4.2.16.Final to 4.2.17.Final. Release notes *Sourced from [io.netty:netty-all's releases](https://github.com/netty/netty/releases).* > netty-4.2.17.Final > ------------------ > > What's Changed > -------------- > > * AsciiString.cached(String) should sanitize the provided String ([#13749](https://redirect.github.com/netty/netty/issues/13749)) by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * Fix deploy workflow by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17071](https://redirect.github.com/netty/netty/pull/17071) > * Fix AsciiString.cached(String) performance regression by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17074](https://redirect.github.com/netty/netty/pull/17074) > * SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17059](https://redirect.github.com/netty/netty/pull/17059) > * Avoid leak presence detector in leak profile by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17073](https://redirect.github.com/netty/netty/pull/17073) > * Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by [`@reta`](https://github.com/reta) in [netty/netty#17068](https://redirect.github.com/netty/netty/pull/17068) > * IoUring: preserve readPending when rescheduling cancelled reads by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17087](https://redirect.github.com/netty/netty/pull/17087) > * Reject negative maxOrder in PooledByteBufAllocator by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#17093](https://redirect.github.com/netty/netty/pull/17093) > * Fix AdaptiveByteBuf.\_setLongLE calling checked setLongLE by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17098](https://redirect.github.com/netty/netty/pull/17098) > * Snappy: Guard decoder against invalid chunk lengths by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17099](https://redirect.github.com/netty/netty/pull/17099) > * Fix OCSP Tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17114](https://redirect.github.com/netty/netty/pull/17114) > * Update to latest netty-tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17056](https://redirect.github.com/netty/netty/pull/17056) > * Use safe decompressor in Lz4FrameDecoder by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17118](https://redirect.github.com/netty/netty/pull/17118) > * Configure TestLens for the PR builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17129](https://redirect.github.com/netty/netty/pull/17129) > * IoUring: add SO\_INQ support for Unix domain sockets by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17127](https://redirect.github.com/netty/netty/pull/17127) > * fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by [`@ChunMengLu`](https://github.com/ChunMengLu) in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * Propagate the CI envionment variables through to the docker builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17138](https://redirect.github.com/netty/netty/pull/17138) > * Codec-compression: Add decompressor API by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16745](https://redirect.github.com/netty/netty/pull/16745) > * Fix silent failures and optimize error short-circuit in multi-threaded tests by [`@rajan-github`](https://github.com/rajan-github) in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * Codec-compression: Add Bzip2Decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17145](https://redirect.github.com/netty/netty/pull/17145) > * Fix buddy cache evicting chunks with live buffers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17154](https://redirect.github.com/netty/netty/pull/17154) > * Codec-compression: Add Snappy frame decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17153](https://redirect.github.com/netty/netty/pull/17153) > * Codec-compression: Add zlib decompressors by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17155](https://redirect.github.com/netty/netty/pull/17155) > * Codec-compression: Add Zstd decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17152](https://redirect.github.com/netty/netty/pull/17152) > * Codec-compression: Add LZF decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17147](https://redirect.github.com/netty/netty/pull/17147) > * Codec-compression: Add BrotliDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17146](https://redirect.github.com/netty/netty/pull/17146) > * Codec-compression: Add Lz4FrameDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17148](https://redirect.github.com/netty/netty/pull/17148) > * `HttpObjectEncoder` / `DefaultHttp2FrameWriter`: fix buffer leak when a `Throwable` is thrown during header encoding by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17089](https://redirect.github.com/netty/netty/pull/17089) > * Fix direct memory OOM on low-core containers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17166](https://redirect.github.com/netty/netty/pull/17166) > * IoUring: Fix the recvmmsg emulation by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17187](https://redirect.github.com/netty/netty/pull/17187) > * Avoid classloader leak via GlobalEventExecutor terminationFuture failure by [`@seonwooj0810`](https://github.com/seonwooj0810) in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * BrotliEncoder: Prevent duplicate close scheduling by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17175](https://redirect.github.com/netty/netty/pull/17175) > * Fix JdkZlibDecompressor losing the tail of highly compressible streams by [`@renechoi`](https://github.com/renechoi) in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) > * Update compress-lzf to 1.2.1 by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17194](https://redirect.github.com/netty/netty/pull/17194) > * Do not write WebSocket handshake response to the tail of the pipeline by [`@el-psy-kongroo-d`](https://github.com/el-psy-kongroo-d) in [netty/netty#17192](https://redirect.github.com/netty/netty/pull/17192) > * `HttpServerCodec`: do not consume the method queue for 1xx interim responses by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17182](https://redirect.github.com/netty/netty/pull/17182) > * Weakly reference engines from the OpenSSL engine map by [`@bryce-anderson`](https://github.com/bryce-anderson) in [netty/netty#17199](https://redirect.github.com/netty/netty/pull/17199) > * OpenSSL: Allow to obtain used named group via OpenSslSession by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17058](https://redirect.github.com/netty/netty/pull/17058) > * Add `.editorconfig` to enforce consistent coding style by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17052](https://redirect.github.com/netty/netty/pull/17052) > * Update surefire plugin to latest version by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17210](https://redirect.github.com/netty/netty/pull/17210) > * Merge changes from forks by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17213](https://redirect.github.com/netty/netty/pull/17213) > > New Contributors > ---------------- > > * [`@vpelikh`](https://github.com/vpelikh) made their first contribution in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * [`@ChunMengLu`](https://github.com/ChunMengLu) made their first contribution in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * [`@rajan-github`](https://github.com/rajan-github) made their first contribution in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * [`@seonwooj0810`](https://github.com/seonwooj0810) made their first contribution in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * [`@renechoi`](https://github.com/renechoi) made their first contribution in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) ... (truncated) Commits * [`e0789d3`](netty/netty@e0789d3) [maven-release-plugin] prepare release netty-4.2.17.Final * [`1b5abc6`](netty/netty@1b5abc6) Merge changes from forks ([#17213](https://redirect.github.com/netty/netty/issues/17213)) * [`36fbf57`](netty/netty@36fbf57) Update surefire plugin to latest version ([#17210](https://redirect.github.com/netty/netty/issues/17210)) * [`a96226c`](netty/netty@a96226c) Add `.editorconfig` to enforce consistent coding style ([#17052](https://redirect.github.com/netty/netty/issues/17052)) * [`14a4e6a`](netty/netty@14a4e6a) OpenSSL: Allow to obtain used named group via OpenSslSession ([#17058](https://redirect.github.com/netty/netty/issues/17058)) * [`26255b1`](netty/netty@26255b1) Weakly reference engines from the OpenSSL engine map ([#17199](https://redirect.github.com/netty/netty/issues/17199)) * [`ae41417`](netty/netty@ae41417) `HttpServerCodec`: do not consume the method queue for 1xx interim responses ... * [`41f1db5`](netty/netty@41f1db5) Do not write WebSocket handshake response to the tail of the pipeline ([#17192](https://redirect.github.com/netty/netty/issues/17192)) * [`035d76e`](netty/netty@035d76e) Update compress-lzf to 1.2.1 ([#17194](https://redirect.github.com/netty/netty/issues/17194)) * [`7681aff`](netty/netty@7681aff) Fix JdkZlibDecompressor losing the tail of highly compressible streams ([#17191](https://redirect.github.com/netty/netty/issues/17191)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.16.Final...netty-4.2.17.Final) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
Aug 9, 2026
…ip ci] Bumps `netty.version` from 4.2.16.Final to 4.2.17.Final. Updates `io.netty:netty-transport` from 4.2.16.Final to 4.2.17.Final Release notes *Sourced from [io.netty:netty-transport's releases](https://github.com/netty/netty/releases).* > netty-4.2.17.Final > ------------------ > > What's Changed > -------------- > > * AsciiString.cached(String) should sanitize the provided String ([#13749](https://redirect.github.com/netty/netty/issues/13749)) by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * Fix deploy workflow by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17071](https://redirect.github.com/netty/netty/pull/17071) > * Fix AsciiString.cached(String) performance regression by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17074](https://redirect.github.com/netty/netty/pull/17074) > * SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17059](https://redirect.github.com/netty/netty/pull/17059) > * Avoid leak presence detector in leak profile by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17073](https://redirect.github.com/netty/netty/pull/17073) > * Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by [`@reta`](https://github.com/reta) in [netty/netty#17068](https://redirect.github.com/netty/netty/pull/17068) > * IoUring: preserve readPending when rescheduling cancelled reads by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17087](https://redirect.github.com/netty/netty/pull/17087) > * Reject negative maxOrder in PooledByteBufAllocator by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#17093](https://redirect.github.com/netty/netty/pull/17093) > * Fix AdaptiveByteBuf.\_setLongLE calling checked setLongLE by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17098](https://redirect.github.com/netty/netty/pull/17098) > * Snappy: Guard decoder against invalid chunk lengths by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17099](https://redirect.github.com/netty/netty/pull/17099) > * Fix OCSP Tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17114](https://redirect.github.com/netty/netty/pull/17114) > * Update to latest netty-tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17056](https://redirect.github.com/netty/netty/pull/17056) > * Use safe decompressor in Lz4FrameDecoder by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17118](https://redirect.github.com/netty/netty/pull/17118) > * Configure TestLens for the PR builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17129](https://redirect.github.com/netty/netty/pull/17129) > * IoUring: add SO\_INQ support for Unix domain sockets by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17127](https://redirect.github.com/netty/netty/pull/17127) > * fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by [`@ChunMengLu`](https://github.com/ChunMengLu) in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * Propagate the CI envionment variables through to the docker builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17138](https://redirect.github.com/netty/netty/pull/17138) > * Codec-compression: Add decompressor API by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16745](https://redirect.github.com/netty/netty/pull/16745) > * Fix silent failures and optimize error short-circuit in multi-threaded tests by [`@rajan-github`](https://github.com/rajan-github) in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * Codec-compression: Add Bzip2Decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17145](https://redirect.github.com/netty/netty/pull/17145) > * Fix buddy cache evicting chunks with live buffers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17154](https://redirect.github.com/netty/netty/pull/17154) > * Codec-compression: Add Snappy frame decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17153](https://redirect.github.com/netty/netty/pull/17153) > * Codec-compression: Add zlib decompressors by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17155](https://redirect.github.com/netty/netty/pull/17155) > * Codec-compression: Add Zstd decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17152](https://redirect.github.com/netty/netty/pull/17152) > * Codec-compression: Add LZF decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17147](https://redirect.github.com/netty/netty/pull/17147) > * Codec-compression: Add BrotliDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17146](https://redirect.github.com/netty/netty/pull/17146) > * Codec-compression: Add Lz4FrameDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17148](https://redirect.github.com/netty/netty/pull/17148) > * `HttpObjectEncoder` / `DefaultHttp2FrameWriter`: fix buffer leak when a `Throwable` is thrown during header encoding by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17089](https://redirect.github.com/netty/netty/pull/17089) > * Fix direct memory OOM on low-core containers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17166](https://redirect.github.com/netty/netty/pull/17166) > * IoUring: Fix the recvmmsg emulation by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17187](https://redirect.github.com/netty/netty/pull/17187) > * Avoid classloader leak via GlobalEventExecutor terminationFuture failure by [`@seonwooj0810`](https://github.com/seonwooj0810) in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * BrotliEncoder: Prevent duplicate close scheduling by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17175](https://redirect.github.com/netty/netty/pull/17175) > * Fix JdkZlibDecompressor losing the tail of highly compressible streams by [`@renechoi`](https://github.com/renechoi) in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) > * Update compress-lzf to 1.2.1 by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17194](https://redirect.github.com/netty/netty/pull/17194) > * Do not write WebSocket handshake response to the tail of the pipeline by [`@el-psy-kongroo-d`](https://github.com/el-psy-kongroo-d) in [netty/netty#17192](https://redirect.github.com/netty/netty/pull/17192) > * `HttpServerCodec`: do not consume the method queue for 1xx interim responses by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17182](https://redirect.github.com/netty/netty/pull/17182) > * Weakly reference engines from the OpenSSL engine map by [`@bryce-anderson`](https://github.com/bryce-anderson) in [netty/netty#17199](https://redirect.github.com/netty/netty/pull/17199) > * OpenSSL: Allow to obtain used named group via OpenSslSession by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17058](https://redirect.github.com/netty/netty/pull/17058) > * Add `.editorconfig` to enforce consistent coding style by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17052](https://redirect.github.com/netty/netty/pull/17052) > * Update surefire plugin to latest version by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17210](https://redirect.github.com/netty/netty/pull/17210) > * Merge changes from forks by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17213](https://redirect.github.com/netty/netty/pull/17213) > > New Contributors > ---------------- > > * [`@vpelikh`](https://github.com/vpelikh) made their first contribution in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * [`@ChunMengLu`](https://github.com/ChunMengLu) made their first contribution in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * [`@rajan-github`](https://github.com/rajan-github) made their first contribution in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * [`@seonwooj0810`](https://github.com/seonwooj0810) made their first contribution in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * [`@renechoi`](https://github.com/renechoi) made their first contribution in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) ... (truncated) Commits * [`e0789d3`](netty/netty@e0789d3) [maven-release-plugin] prepare release netty-4.2.17.Final * [`1b5abc6`](netty/netty@1b5abc6) Merge changes from forks ([#17213](https://redirect.github.com/netty/netty/issues/17213)) * [`36fbf57`](netty/netty@36fbf57) Update surefire plugin to latest version ([#17210](https://redirect.github.com/netty/netty/issues/17210)) * [`a96226c`](netty/netty@a96226c) Add `.editorconfig` to enforce consistent coding style ([#17052](https://redirect.github.com/netty/netty/issues/17052)) * [`14a4e6a`](netty/netty@14a4e6a) OpenSSL: Allow to obtain used named group via OpenSslSession ([#17058](https://redirect.github.com/netty/netty/issues/17058)) * [`26255b1`](netty/netty@26255b1) Weakly reference engines from the OpenSSL engine map ([#17199](https://redirect.github.com/netty/netty/issues/17199)) * [`ae41417`](netty/netty@ae41417) `HttpServerCodec`: do not consume the method queue for 1xx interim responses ... * [`41f1db5`](netty/netty@41f1db5) Do not write WebSocket handshake response to the tail of the pipeline ([#17192](https://redirect.github.com/netty/netty/issues/17192)) * [`035d76e`](netty/netty@035d76e) Update compress-lzf to 1.2.1 ([#17194](https://redirect.github.com/netty/netty/issues/17194)) * [`7681aff`](netty/netty@7681aff) Fix JdkZlibDecompressor losing the tail of highly compressible streams ([#17191](https://redirect.github.com/netty/netty/issues/17191)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.16.Final...netty-4.2.17.Final) Updates `io.netty:netty-codec` from 4.2.16.Final to 4.2.17.Final Release notes *Sourced from [io.netty:netty-codec's releases](https://github.com/netty/netty/releases).* > netty-4.2.17.Final > ------------------ > > What's Changed > -------------- > > * AsciiString.cached(String) should sanitize the provided String ([#13749](https://redirect.github.com/netty/netty/issues/13749)) by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * Fix deploy workflow by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17071](https://redirect.github.com/netty/netty/pull/17071) > * Fix AsciiString.cached(String) performance regression by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17074](https://redirect.github.com/netty/netty/pull/17074) > * SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17059](https://redirect.github.com/netty/netty/pull/17059) > * Avoid leak presence detector in leak profile by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17073](https://redirect.github.com/netty/netty/pull/17073) > * Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by [`@reta`](https://github.com/reta) in [netty/netty#17068](https://redirect.github.com/netty/netty/pull/17068) > * IoUring: preserve readPending when rescheduling cancelled reads by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17087](https://redirect.github.com/netty/netty/pull/17087) > * Reject negative maxOrder in PooledByteBufAllocator by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#17093](https://redirect.github.com/netty/netty/pull/17093) > * Fix AdaptiveByteBuf.\_setLongLE calling checked setLongLE by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17098](https://redirect.github.com/netty/netty/pull/17098) > * Snappy: Guard decoder against invalid chunk lengths by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17099](https://redirect.github.com/netty/netty/pull/17099) > * Fix OCSP Tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17114](https://redirect.github.com/netty/netty/pull/17114) > * Update to latest netty-tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17056](https://redirect.github.com/netty/netty/pull/17056) > * Use safe decompressor in Lz4FrameDecoder by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17118](https://redirect.github.com/netty/netty/pull/17118) > * Configure TestLens for the PR builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17129](https://redirect.github.com/netty/netty/pull/17129) > * IoUring: add SO\_INQ support for Unix domain sockets by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17127](https://redirect.github.com/netty/netty/pull/17127) > * fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by [`@ChunMengLu`](https://github.com/ChunMengLu) in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * Propagate the CI envionment variables through to the docker builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17138](https://redirect.github.com/netty/netty/pull/17138) > * Codec-compression: Add decompressor API by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16745](https://redirect.github.com/netty/netty/pull/16745) > * Fix silent failures and optimize error short-circuit in multi-threaded tests by [`@rajan-github`](https://github.com/rajan-github) in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * Codec-compression: Add Bzip2Decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17145](https://redirect.github.com/netty/netty/pull/17145) > * Fix buddy cache evicting chunks with live buffers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17154](https://redirect.github.com/netty/netty/pull/17154) > * Codec-compression: Add Snappy frame decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17153](https://redirect.github.com/netty/netty/pull/17153) > * Codec-compression: Add zlib decompressors by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17155](https://redirect.github.com/netty/netty/pull/17155) > * Codec-compression: Add Zstd decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17152](https://redirect.github.com/netty/netty/pull/17152) > * Codec-compression: Add LZF decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17147](https://redirect.github.com/netty/netty/pull/17147) > * Codec-compression: Add BrotliDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17146](https://redirect.github.com/netty/netty/pull/17146) > * Codec-compression: Add Lz4FrameDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17148](https://redirect.github.com/netty/netty/pull/17148) > * `HttpObjectEncoder` / `DefaultHttp2FrameWriter`: fix buffer leak when a `Throwable` is thrown during header encoding by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17089](https://redirect.github.com/netty/netty/pull/17089) > * Fix direct memory OOM on low-core containers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17166](https://redirect.github.com/netty/netty/pull/17166) > * IoUring: Fix the recvmmsg emulation by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17187](https://redirect.github.com/netty/netty/pull/17187) > * Avoid classloader leak via GlobalEventExecutor terminationFuture failure by [`@seonwooj0810`](https://github.com/seonwooj0810) in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * BrotliEncoder: Prevent duplicate close scheduling by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17175](https://redirect.github.com/netty/netty/pull/17175) > * Fix JdkZlibDecompressor losing the tail of highly compressible streams by [`@renechoi`](https://github.com/renechoi) in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) > * Update compress-lzf to 1.2.1 by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17194](https://redirect.github.com/netty/netty/pull/17194) > * Do not write WebSocket handshake response to the tail of the pipeline by [`@el-psy-kongroo-d`](https://github.com/el-psy-kongroo-d) in [netty/netty#17192](https://redirect.github.com/netty/netty/pull/17192) > * `HttpServerCodec`: do not consume the method queue for 1xx interim responses by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17182](https://redirect.github.com/netty/netty/pull/17182) > * Weakly reference engines from the OpenSSL engine map by [`@bryce-anderson`](https://github.com/bryce-anderson) in [netty/netty#17199](https://redirect.github.com/netty/netty/pull/17199) > * OpenSSL: Allow to obtain used named group via OpenSslSession by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17058](https://redirect.github.com/netty/netty/pull/17058) > * Add `.editorconfig` to enforce consistent coding style by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17052](https://redirect.github.com/netty/netty/pull/17052) > * Update surefire plugin to latest version by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17210](https://redirect.github.com/netty/netty/pull/17210) > * Merge changes from forks by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17213](https://redirect.github.com/netty/netty/pull/17213) > > New Contributors > ---------------- > > * [`@vpelikh`](https://github.com/vpelikh) made their first contribution in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * [`@ChunMengLu`](https://github.com/ChunMengLu) made their first contribution in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * [`@rajan-github`](https://github.com/rajan-github) made their first contribution in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * [`@seonwooj0810`](https://github.com/seonwooj0810) made their first contribution in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * [`@renechoi`](https://github.com/renechoi) made their first contribution in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) ... (truncated) Commits * [`e0789d3`](netty/netty@e0789d3) [maven-release-plugin] prepare release netty-4.2.17.Final * [`1b5abc6`](netty/netty@1b5abc6) Merge changes from forks ([#17213](https://redirect.github.com/netty/netty/issues/17213)) * [`36fbf57`](netty/netty@36fbf57) Update surefire plugin to latest version ([#17210](https://redirect.github.com/netty/netty/issues/17210)) * [`a96226c`](netty/netty@a96226c) Add `.editorconfig` to enforce consistent coding style ([#17052](https://redirect.github.com/netty/netty/issues/17052)) * [`14a4e6a`](netty/netty@14a4e6a) OpenSSL: Allow to obtain used named group via OpenSslSession ([#17058](https://redirect.github.com/netty/netty/issues/17058)) * [`26255b1`](netty/netty@26255b1) Weakly reference engines from the OpenSSL engine map ([#17199](https://redirect.github.com/netty/netty/issues/17199)) * [`ae41417`](netty/netty@ae41417) `HttpServerCodec`: do not consume the method queue for 1xx interim responses ... * [`41f1db5`](netty/netty@41f1db5) Do not write WebSocket handshake response to the tail of the pipeline ([#17192](https://redirect.github.com/netty/netty/issues/17192)) * [`035d76e`](netty/netty@035d76e) Update compress-lzf to 1.2.1 ([#17194](https://redirect.github.com/netty/netty/issues/17194)) * [`7681aff`](netty/netty@7681aff) Fix JdkZlibDecompressor losing the tail of highly compressible streams ([#17191](https://redirect.github.com/netty/netty/issues/17191)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.16.Final...netty-4.2.17.Final) Updates `io.netty:netty-handler` from 4.2.16.Final to 4.2.17.Final Release notes *Sourced from [io.netty:netty-handler's releases](https://github.com/netty/netty/releases).* > netty-4.2.17.Final > ------------------ > > What's Changed > -------------- > > * AsciiString.cached(String) should sanitize the provided String ([#13749](https://redirect.github.com/netty/netty/issues/13749)) by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * Fix deploy workflow by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17071](https://redirect.github.com/netty/netty/pull/17071) > * Fix AsciiString.cached(String) performance regression by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17074](https://redirect.github.com/netty/netty/pull/17074) > * SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17059](https://redirect.github.com/netty/netty/pull/17059) > * Avoid leak presence detector in leak profile by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17073](https://redirect.github.com/netty/netty/pull/17073) > * Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by [`@reta`](https://github.com/reta) in [netty/netty#17068](https://redirect.github.com/netty/netty/pull/17068) > * IoUring: preserve readPending when rescheduling cancelled reads by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17087](https://redirect.github.com/netty/netty/pull/17087) > * Reject negative maxOrder in PooledByteBufAllocator by [`@coderbruis`](https://github.com/coderbruis) in [netty/netty#17093](https://redirect.github.com/netty/netty/pull/17093) > * Fix AdaptiveByteBuf.\_setLongLE calling checked setLongLE by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17098](https://redirect.github.com/netty/netty/pull/17098) > * Snappy: Guard decoder against invalid chunk lengths by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17099](https://redirect.github.com/netty/netty/pull/17099) > * Fix OCSP Tests by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17114](https://redirect.github.com/netty/netty/pull/17114) > * Update to latest netty-tcnative release by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17056](https://redirect.github.com/netty/netty/pull/17056) > * Use safe decompressor in Lz4FrameDecoder by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17118](https://redirect.github.com/netty/netty/pull/17118) > * Configure TestLens for the PR builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17129](https://redirect.github.com/netty/netty/pull/17129) > * IoUring: add SO\_INQ support for Unix domain sockets by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17127](https://redirect.github.com/netty/netty/pull/17127) > * fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by [`@ChunMengLu`](https://github.com/ChunMengLu) in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * Propagate the CI envionment variables through to the docker builds by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17138](https://redirect.github.com/netty/netty/pull/17138) > * Codec-compression: Add decompressor API by [`@yawkat`](https://github.com/yawkat) in [netty/netty#16745](https://redirect.github.com/netty/netty/pull/16745) > * Fix silent failures and optimize error short-circuit in multi-threaded tests by [`@rajan-github`](https://github.com/rajan-github) in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * Codec-compression: Add Bzip2Decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17145](https://redirect.github.com/netty/netty/pull/17145) > * Fix buddy cache evicting chunks with live buffers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17154](https://redirect.github.com/netty/netty/pull/17154) > * Codec-compression: Add Snappy frame decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17153](https://redirect.github.com/netty/netty/pull/17153) > * Codec-compression: Add zlib decompressors by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17155](https://redirect.github.com/netty/netty/pull/17155) > * Codec-compression: Add Zstd decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17152](https://redirect.github.com/netty/netty/pull/17152) > * Codec-compression: Add LZF decompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17147](https://redirect.github.com/netty/netty/pull/17147) > * Codec-compression: Add BrotliDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17146](https://redirect.github.com/netty/netty/pull/17146) > * Codec-compression: Add Lz4FrameDecompressor by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17148](https://redirect.github.com/netty/netty/pull/17148) > * `HttpObjectEncoder` / `DefaultHttp2FrameWriter`: fix buffer leak when a `Throwable` is thrown during header encoding by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17089](https://redirect.github.com/netty/netty/pull/17089) > * Fix direct memory OOM on low-core containers by [`@franz1981`](https://github.com/franz1981) in [netty/netty#17166](https://redirect.github.com/netty/netty/pull/17166) > * IoUring: Fix the recvmmsg emulation by [`@dreamlike-ocean`](https://github.com/dreamlike-ocean) in [netty/netty#17187](https://redirect.github.com/netty/netty/pull/17187) > * Avoid classloader leak via GlobalEventExecutor terminationFuture failure by [`@seonwooj0810`](https://github.com/seonwooj0810) in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * BrotliEncoder: Prevent duplicate close scheduling by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17175](https://redirect.github.com/netty/netty/pull/17175) > * Fix JdkZlibDecompressor losing the tail of highly compressible streams by [`@renechoi`](https://github.com/renechoi) in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) > * Update compress-lzf to 1.2.1 by [`@yawkat`](https://github.com/yawkat) in [netty/netty#17194](https://redirect.github.com/netty/netty/pull/17194) > * Do not write WebSocket handshake response to the tail of the pipeline by [`@el-psy-kongroo-d`](https://github.com/el-psy-kongroo-d) in [netty/netty#17192](https://redirect.github.com/netty/netty/pull/17192) > * `HttpServerCodec`: do not consume the method queue for 1xx interim responses by [`@HwangRock`](https://github.com/HwangRock) in [netty/netty#17182](https://redirect.github.com/netty/netty/pull/17182) > * Weakly reference engines from the OpenSSL engine map by [`@bryce-anderson`](https://github.com/bryce-anderson) in [netty/netty#17199](https://redirect.github.com/netty/netty/pull/17199) > * OpenSSL: Allow to obtain used named group via OpenSslSession by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17058](https://redirect.github.com/netty/netty/pull/17058) > * Add `.editorconfig` to enforce consistent coding style by [`@vpelikh`](https://github.com/vpelikh) in [netty/netty#17052](https://redirect.github.com/netty/netty/pull/17052) > * Update surefire plugin to latest version by [`@normanmaurer`](https://github.com/normanmaurer) in [netty/netty#17210](https://redirect.github.com/netty/netty/pull/17210) > * Merge changes from forks by [`@chrisvest`](https://github.com/chrisvest) in [netty/netty#17213](https://redirect.github.com/netty/netty/pull/17213) > > New Contributors > ---------------- > > * [`@vpelikh`](https://github.com/vpelikh) made their first contribution in [netty/netty#17007](https://redirect.github.com/netty/netty/pull/17007) > * [`@ChunMengLu`](https://github.com/ChunMengLu) made their first contribution in [netty/netty#17117](https://redirect.github.com/netty/netty/pull/17117) > * [`@rajan-github`](https://github.com/rajan-github) made their first contribution in [netty/netty#17106](https://redirect.github.com/netty/netty/pull/17106) > * [`@seonwooj0810`](https://github.com/seonwooj0810) made their first contribution in [netty/netty#17140](https://redirect.github.com/netty/netty/pull/17140) > * [`@renechoi`](https://github.com/renechoi) made their first contribution in [netty/netty#17191](https://redirect.github.com/netty/netty/pull/17191) ... (truncated) Commits * [`e0789d3`](netty/netty@e0789d3) [maven-release-plugin] prepare release netty-4.2.17.Final * [`1b5abc6`](netty/netty@1b5abc6) Merge changes from forks ([#17213](https://redirect.github.com/netty/netty/issues/17213)) * [`36fbf57`](netty/netty@36fbf57) Update surefire plugin to latest version ([#17210](https://redirect.github.com/netty/netty/issues/17210)) * [`a96226c`](netty/netty@a96226c) Add `.editorconfig` to enforce consistent coding style ([#17052](https://redirect.github.com/netty/netty/issues/17052)) * [`14a4e6a`](netty/netty@14a4e6a) OpenSSL: Allow to obtain used named group via OpenSslSession ([#17058](https://redirect.github.com/netty/netty/issues/17058)) * [`26255b1`](netty/netty@26255b1) Weakly reference engines from the OpenSSL engine map ([#17199](https://redirect.github.com/netty/netty/issues/17199)) * [`ae41417`](netty/netty@ae41417) `HttpServerCodec`: do not consume the method queue for 1xx interim responses ... * [`41f1db5`](netty/netty@41f1db5) Do not write WebSocket handshake response to the tail of the pipeline ([#17192](https://redirect.github.com/netty/netty/issues/17192)) * [`035d76e`](netty/netty@035d76e) Update compress-lzf to 1.2.1 ([#17194](https://redirect.github.com/netty/netty/issues/17194)) * [`7681aff`](netty/netty@7681aff) Fix JdkZlibDecompressor losing the tail of highly compressible streams ([#17191](https://redirect.github.com/netty/netty/issues/17191)) * Additional commits viewable in [compare view](netty/netty@netty-4.2.16.Final...netty-4.2.17.Final) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
11 tasks
chrisvest
pushed a commit
that referenced
this pull request
Aug 12, 2026
Motivation: `encodeInitHttpMessage()` updated the encoder state before running header sanitization and encoding. If either step threw, the allocated buffer was released but the encoder remained in a content state even though no output had been produced. A subsequent valid response was then rejected with `unexpected message type`. This can be reproduced without a fatal error by encoding a `204 No Content` response backed by `ReadOnlyHttpHeaders`. Sanitization fails with `UnsupportedOperationException`, and the next response fails because the encoder is still in state 3. #17089 made the header buffer exception-safe, but its regression test ended the channel immediately after the failure and did not exercise another response. Modification: - Compute the next content state in a local variable. - Commit it to the encoder only after header sanitization and encoding complete successfully. - Add a regression test for a sanitization failure and extend the existing header encoding failure test to verify that a valid response can still be encoded afterward. Result: An initial-message header failure no longer leaves the encoder unusable. Successful encoding and wire output are unchanged. Verification: `./mvnw -pl codec-http test` 8,982 tests run, 0 failures, 0 errors, 4 skipped.
This was referenced Aug 12, 2026
normanmaurer
pushed a commit
that referenced
this pull request
Aug 13, 2026
…lures (#17275) Auto-port of #17271 to 4.1 Cherry-picked commit: dd7c9dc --- Motivation: `encodeInitHttpMessage()` updated the encoder state before running header sanitization and encoding. If either step threw, the allocated buffer was released but the encoder remained in a content state even though no output had been produced. A subsequent valid response was then rejected with `unexpected message type`. This can be reproduced without a fatal error by encoding a `204 No Content` response backed by `ReadOnlyHttpHeaders`. Sanitization fails with `UnsupportedOperationException`, and the next response fails because the encoder is still in state 3. #17089 made the header buffer exception-safe, but its regression test ended the channel immediately after the failure and did not exercise another response. Modification: - Compute the next content state in a local variable. - Commit it to the encoder only after header sanitization and encoding complete successfully. - Add a regression test for a sanitization failure and extend the existing header encoding failure test to verify that a valid response can still be encoded afterward. Result: An initial-message header failure no longer leaves the encoder unusable. Successful encoding and wire output are unchanged. Verification: `./mvnw -pl codec-http test` 8,982 tests run, 0 failures, 0 errors, 4 skipped. Co-authored-by: Gimin Kim <138752849+Gimini-3@users.noreply.github.com>
normanmaurer
added a commit
that referenced
this pull request
Aug 13, 2026
…lures (#17274) Auto-port of #17271 to 5.0 Cherry-picked commit: dd7c9dc --- Motivation: `encodeInitHttpMessage()` updated the encoder state before running header sanitization and encoding. If either step threw, the allocated buffer was released but the encoder remained in a content state even though no output had been produced. A subsequent valid response was then rejected with `unexpected message type`. This can be reproduced without a fatal error by encoding a `204 No Content` response backed by `ReadOnlyHttpHeaders`. Sanitization fails with `UnsupportedOperationException`, and the next response fails because the encoder is still in state 3. #17089 made the header buffer exception-safe, but its regression test ended the channel immediately after the failure and did not exercise another response. Modification: - Compute the next content state in a local variable. - Commit it to the encoder only after header sanitization and encoding complete successfully. - Add a regression test for a sanitization failure and extend the existing header encoding failure test to verify that a valid response can still be encoded afterward. Result: An initial-message header failure no longer leaves the encoder unusable. Successful encoding and wire output are unchanged. Verification: `./mvnw -pl codec-http test` 8,982 tests run, 0 failures, 0 errors, 4 skipped. --------- Co-authored-by: Gimin Kim <138752849+Gimini-3@users.noreply.github.com> Co-authored-by: Norman Maurer <norman_maurer@apple.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Fixes #17088. Same class of bug as the SslHandler leak fixed in #17059: a header buffer is allocated, then a Throwable (typically OutOfMemoryError) is thrown before the buffer is handed off, leaving it unreleased. #6729 reported the exact symptom on HttpObjectEncoder.encodeHeaders back in 2017 but couldn't be reproduced on demand and was closed; the root cause was never fixed.
Affected paths:
With pooled direct buffers this leaks off-heap memory the GC cannot reclaim, so repeated OOME on these paths ends in OutOfDirectMemoryError / process death.
Modification
Result
No buffer leak when a Throwable is thrown mid header encoding. The normal path is unchanged.
Measured with the tracking allocator (each OOME on these paths leaks exactly one header buffer, so the leak grows linearly with the number of affected requests):
At scale on the 256 B paths that is ~244 MiB leaked per 1M affected requests; on the CONTINUATION path (large headers) ~61 GiB per 1M. After the fix the leak is 0 regardless of request count.