Description of the patch:
This update for netty, netty-tcnative fixes the following issue
This update for netty, netty-tcnative fixes the following issues
Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:
- CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
- CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
- CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
- CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
- CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
- CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
- CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
- CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
- CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments
(bsc#1268250).
- CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
- CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
- CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in
RedisArrayAggregator (bsc#1268255).
- CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
- CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers
(bsc#1268258).
- CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
- CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
- CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial...