From 323c2dfcf08b947bea16abfe7cf99e224eda12ca Mon Sep 17 00:00:00 2001
From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com>
Date: Thu, 17 Sep 2026 14:23:18 -0400
Subject: [PATCH] build(deps): bump io.netty:netty-* 4.1.136.Final ->
 4.1.137.Final (CVE-2026-75595 + CVE-2026-75596)

Dependabot alerts #169 (critical, CVE-2026-75595) and #168 (medium,
CVE-2026-75596) on io.netty:netty-handler are closed by this bump.

CVE-2026-75595 (critical, CVSS 9.1): SNI Routing Bypass via Fragmented
TLS ClientHello. SslClientHelloHandler.decode checks the wrong offset for
the handshake header guard; a fragmented ClientHello whose record header
spans the 5-byte TLS record header + 4-byte handshake boundary silently
falls back to the default SslContext. Per-SNI mTLS gates are bypassed.
Fix in 4.1.137.Final + 4.2.17.Final.

CVE-2026-75596 (medium, CVSS 6.9): Fragmented ClientHello records trigger
quadratic pre-handshake reassembly in default SNI parsing. With 4095
one-byte fragments the handler recopies 8,386,560 bytes from 24,579 bytes
on the wire (341x amplification), exhausting the event-loop CPU before
SslHandler takes over.
Fix in 4.1.137.Final + 4.2.17.Final.

Both CVEs have no Java 1.8 fix line below 4.1.137.Final; 4.1.137.Final
is on the same 4.1.x line we already pin and is compiled for Java 6+
(class major version 50 verified on SslClientHelloHandler.class), so it
is Java 1.8-compatible.

Verification:
  ./mvn-env.sh dependency:tree -pl system
  -> netty-codec, netty-common, netty-handler, netty-resolver, netty-transport,
     netty-transport-classes-epoll, netty-transport-native-epoll,
     netty-transport-native-unix-common all resolved to 4.1.137.Final.
  ./mvn-env.sh test-compile -pl system -am -DskipTests
  -> BUILD SUCCESS.

> Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e3e5512bc..83d2f963a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -177,7 +177,7 @@
         <maven.war.plugin.version>3.5.1</maven.war.plugin.version>
         <mssql.version>13.3.0.jre8-preview</mssql.version>
         <myfaces.version>2.3.11</myfaces.version>
-        <nettyall.version>4.1.136.Final</nettyall.version>
+        <nettyall.version>4.1.137.Final</nettyall.version>
         <ojdbc8.version>19.3.0.0</ojdbc8.version>
         <opencsv.version>5.12.0</opencsv.version>
         <oracle.version>12.1.0.1</oracle.version>