Security Update: Address high/critical CVEs in dependencies

[alextitov1]

Hi team,

In addition to the open PR, our vulnerability reports the following CVEs in the dependency tree

CVE	Package	Component Type	Severity	Version
CVE-2025-24970	io.netty:netty-handler	Java Code Library	High	4.1.118.Final
CVE-2026-44249	io.netty:netty-handler	Java Code Library	High	4.1.135.Final
CVE-2026-45416	io.netty:netty-handler	Java Code Library	High	4.1.135.Final
CVE-2026-50010	io.netty:netty-handler	Java Code Library	High	4.1.135.Final
CVE-2026-42583	io.netty:netty-codec	Java Code Library	High	4.1.133.Final

Could we look into updating these to the patched versions?

@vlsi please consider updating these dependencies in your open PR.

[vlsi]

Thanks for the report. A quick check on the release/5.6.x branch (and on the rel/v5.6.3 baseline) shows that JMeter does not ship any netty jar:

$ grep -i netty src/dist/src/dist/expected_release_jars.csv
(no matches)
$ ./gradlew :src:protocol:bolt:dependencies --configuration runtimeClasspath | grep netty
(no matches)

The bolt protocol module uses neo4j-java-driver:4.4.13, which still ships the legacy non-netty transport. Netty only entered JMeter's dependency tree on master, where neo4j-java-driver was bumped to 6.x — and master carries netty 4.2.7.Final, not the 4.1.118 / 4.1.135 / 4.1.133 versions mentioned in the report.

Could you confirm:

• which artifact you scanned (a stock apache-jmeter-5.6.3.tgz or an installation extended with third-party plugins),
• which plugins are deployed in lib/ext/?

If netty shows up via a plugin (jmeter-plugins, Pulsar, Kafka, gRPC, MQTT, etc.), the fix needs to come from that plugin's vendor; JMeter core has no leverage over the netty version pulled by an external plugin.

[alextitov1]

We downloaded JMeter from this link https://dlcdn.apache.org//jmeter/binaries/;

tar -xzf /tmp/jmeter-5.6.3.tgz -C /opt/jmeter

Here is the report from the vulnerability scanner for one of the CVEs

The library io.netty:netty-handler version 4.1.104.Final was detected in Maven library manager located at /opt/jmeter/lib/neo4j-java-driver-4.4.13.jar -> META-INF/maven/io.netty/netty-handler and is vulnerable to CVE-2025-24970, which exists in versions >= 4.1.91.Final, <= 4.1.117.Final