Bump netty to 4.1.137.Final to clear CVE-2025-59419 in the Flink job-server jar - #6
Merged
Conversation
The Flink job-server fat jar bundles io.netty:netty-all, the aggregate artifact that ships every codec including netty-codec-smtp. At 4.1.124.Final that codec carries CVE-2025-59419 (SMTP command injection via unvalidated CRLF in DefaultSmtpRequest), which surfaces as a HIGH finding on Glean's flink-invoker image. 4.1.137.Final is the latest 4.1.x, well past the 4.1.129.Final fix, and matches the netty-all pin already used in scio's Java graph. Upstream Beam master is on 4.1.133.Final, so this is not ahead of what Beam itself tests against. Rebuilding :runners:flink:2.0:job-server:shadowJar with this change alters only entries under io/netty/ (19 removed, 45 added); no Beam or Flink class changes. Co-authored-by: Cursor <cursoragent@cursor.com>
xinyu-liu-glean
requested review from
amy-li-glean,
ranjithkumar-glean and
timmy-xiao-glean
September 2, 2026 23:04
timmy-xiao-glean
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BeamModulePlugin.groovy:853declaresio.netty:netty-all, the aggregate that drags innetty-codec-smtp; at4.1.124.Finalthat's CVE-2025-59419 (CRLF injection inDefaultSmtpRequest), a HIGH finding on Glean'sflink-invokerimage across 44 tags. Tracked as EN-1741466.netty_versionto4.1.137.Final— latest 4.1.x, past the4.1.129.Finalfix, matches thenetty-allpin in scio'sMODULE.bazel. Upstream Beam master is on4.1.133.Final, so this isn't ahead of what Beam tests against.[bomupgrader]marker means a future BOM sync would silently regress this, so the line carries a comment saying it's deliberately held high.:runners:flink:2.0:job-server:shadowJar: all 31io.nettyartifacts move to4.1.137.Final; the fix is visible in bytecode (SmtpUtils.class835 → 2433 bytes,DefaultSmtpRequest.class3000 → 3114); the entry-list diff vs. the deployed jar is entirely underio/netty/(19 removed, 45 added); the jar boots and runs a real pipeline end to end.beam-runners-flink-2.0-job-server-2.73.0-netty-4.1.137.jar(sha25607807c77cd9981af4a304fbadcf358b42405764ace3e076fc792cd3cb44c03dd).org/apache/flink/shaded/netty4/…/smtp/) comes fromflink-shaded-nettyand is untouched — no Maven coordinates so scanners don't flag it, and equally unreachable. The codec was never callable anyway (0 references across 158,648 classes), so this stops shipping vulnerable bytes rather than closing a live hole.