fix(deps): bump netty-handler 4.1.136 → 4.1.137 for CVE-2026-75595

[subrata71]

Description

Bumps io.netty:netty-handler from 4.1.136.Final to 4.1.137.Final to
fix CVE-2026-75595
(GHSA-c4c3-7fpv-j4q5).

What is CVE-2026-75595?
A fragmented TLS ClientHello whose handshake header spans records triggers an
IndexOutOfBoundsException in SslClientHelloHandler#decode, causing Netty to
fall back to the default SslContext instead of the SNI-specific one. In
deployments relying solely on per-SNI mTLS selection, this lets an
unauthenticated client bypass the mTLS requirement.

Practical exploitability in Appsmith: Very low. TLS termination happens at
Caddy, not inside the Java server. Appsmith does not use Netty's
SslClientHelloHandler for SNI-based mTLS routing. The bump removes the scanner
finding.

What this fixes (5 of 6 scanner findings):

• server.jar (BOOT-INF/lib/netty-handler)
• awsLambdaPlugin-v2.4.jar
• dynamoPlugin-v2.4.jar
• firestorePlugin-v2.4.jar
• mysqlPlugin-v2.4.jar

Not covered here: /opt/keycloak/lib/…/netty-handler-4.1.136.Final.jar —
Keycloak is EE-only (not present in CE base.dockerfile). That fix will be a
separate EE-only change (Keycloak version bump or JAR overlay).

Regression risk: Minimal. This is a patch bump (136→137) within the 4.1.x
series. The fix touches only the TLS ClientHello parser
(SslClientHelloHandler#decode). No HTTP, codec, or transport API changes.
Spring Boot 3.5.16 is compatible.

Impact on existing instances

• Fresh install: gets 4.1.137 — no action needed.
• Upgrade from default: gets 4.1.137 — transparent, no config changes.
• Upgrade from customized: no user-facing config related to netty version.
• Rollback: reverts to 4.1.136 — re-exposes the CVE but no functional breakage.

Automation

/ok-to-test tags="@tag.All"

🔍 Cypress test results

Communication

Should the DevRel and Marketing teams inform users about this change?

• Yes
• No

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/34449300280
Commit: ba35b62
Cypress dashboard.
Tags: @tag.All
Spec:

---

Thu, 10 Sep 2026 08:36:02 UTC

Summary by CodeRabbit

• Chores
  • Updated the server’s Netty dependency to version 4.1.137.Final.
  • Added a security reference for CVE-2026-75595.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 4bc3303d-cb8a-4758-889a-fb162e21ec75

📥 Commits

Reviewing files that changed from the base of the PR and between 2a42b02 and ba35b62.

📒 Files selected for processing (1)

• app/server/pom.xml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The server Maven configuration updates the managed Netty version from 4.1.136.Final to 4.1.137.Final and adds CVE-2026-75595 to the security comment.

Changes

Netty dependency update

Layer / File(s)	Summary
Update managed Netty version app/server/pom.xml	The managed Netty version changes to 4.1.137.Final. The security comment includes CVE-2026-75595.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: sebastianiv21, sondermanish, wyattwalter

Merge Risk: ⚪ Minimal · up to ba35b

This patch-level Netty security update changes no application configuration or public behavior, and no current merge-readiness risks remain.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Netty dependency bump and the CVE addressed. It is concise and accurately reflects the main change.
Description check	✅ Passed	The description includes the change, security context, affected artifacts, scope limitations, regression risk, deployment impact, testing information, and communication decision. It does not provide a…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/CVE-2026-75595-netty-handler-bump

---

_{Netty climbs one version high
A CVE note is written by
Maven keeps the path in tune
Builds align beneath the moon
One small change, clear and bright}

_{Comment @coderabbitai help to get the list of available commands.}

[subrata71]

/build-deploy-preview skip-tests=true

[github-actions]

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/34457196191.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 42217.
recreate: .
base-image-tag: .

[github-actions]

Deploy-Preview-URL: https://ce-42217.dp.appsmith.com