Package
elasticsearch-9.4-iamguarded
Component
netty-codec-http
Latest update
6.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Upgrading netty from 4.1.135.Final to 4.1.136.Final fixes this vulnerability but is blocked by a known upstream netty defect. Elasticsearch 9.4 builds its HTTP transport on netty's FlowControlHandler, which does not reliably deliver one message per read() as documented (netty/netty#17050). With netty 4.1.136.Final this package builds but fails its test: Elasticsearch starts and binds port 9200, then elasticsearch-reset-password exits 69 with "Failed to determine the health of the cluster." Resolution requires an upstream netty release that restores the documented FlowControlHandler behaviour. Upstream tracking: https://github.com/netty/netty/issues/17050
Status