Package
zaproxy
Component
netty-codec-http2
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
This component is bundled inside the pre-built ZAP "network" add-on at /zap/plugin/network-beta-0.29.0.zap. zaproxy fetches its add-ons pre-built from the ZAP marketplace during the build (zap.sh -cmd -silent -addonupdate), so the netty jars merged into the add-on cannot be reached through dependency management and cannot be remediated in this package. network 0.29.0 (2026-08-07) is the newest network add-on upstream publishes for ZAP 2.17 (zap-admin ZapVersions-2.17.xml), and upstream zap-extensions main still pins the affected netty 4.1.134.Final (https://github.com/zaproxy/zap-extensions/blob/main/gradle/libs.versions.toml); the fixes ship in netty 4.1.135-4.1.137. Remediation depends on upstream releasing a network add-on built against netty >= 4.1.137.Final. Rebuilding the add-on from source with a bumped netty was evaluated and withdrawn as too invasive for this package (https://github.com/chainguard-dev/stereo/pull/320062).
Status
Previous location
/zap/plugin/network-beta-0.28.0.zapNew location
/zap/plugin/network-beta-0.29.0.zapImpact
version-only path change detected during APK rebuild
Status
Impact
Bundled in the upstream network plugin, upstream will need to upgrade the dependency and issue a new release.
Status