[Aikido] Fix 20 security issues in netty-handler, netty-codec-http2, netty-codec-socks and 13 more

[aikido-autofix]

Upgrade dependencies to fix critical mTLS bypass via SNI misconfiguration, hostname verification failures on Java 25+, HTTP/1-to-HTTP/2 conversion vulnerabilities enabling host boundary bypass and request smuggling, and Extended CONNECT downgrade attacks.

⚠️ Incomplete breaking changes analysis (6/16 analyzed)

⚠️ Breaking changes analysis not available for: org.springframework:spring-core, org.springframework:spring-webmvc, org.springframework:spring-web, org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-context, io.projectreactor.netty:reactor-netty-http, io.projectreactor:reactor-core, org.jetbrains.kotlin:kotlin-stdlib, io.projectreactor.netty:reactor-netty-core

✅ No breaking changes from the Kotlin stdlib upgrade (1.9.25 => 2.1.0) affect this codebase. The code uses standard Kotlin patterns that are fully compatible with Kotlin 2.0+ and does not use any of the deprecated APIs or problematic patterns mentioned in the changelog.

All breaking changes by upgrading org.jetbrains.kotlin:kotlin-stdlib-jdk7 from version 1.9.25 to 2.1.0 (CHANGELOG)

Version	Description
2.1.0	KT-85062 Deprecate language version 2.1
2.1.0	KT-79663 KLIB-based compilers: Promote partial linkage to "always on"
2.1.0	KT-76934 Drop old IR parameter API
2.1.0	KT-72950 Partial Linkage: Change the semantics of -Xpartial-linkage-loglevel
2.1.0	KT-84714 KJS: Forbid exporting properties with context parameters
2.1.0	KT-67809 Native: remove support for non-opaque LLVM pointer types
2.1.0	KT-82127 Remove generator-based coroutines intrinsics after bootstrap
2.1.0	KT-83992 Drop K1 JS entry point and IC code
2.1.0	KT-84684 Remove UserVisibleIrModulesSupport from IR linker
2.1.0	KT-85122 Deprecate kotlin.io.readLine with WARNING
2.1.0	KT-84970 Deprecate AbstractCoroutineContextKey and associated API
2.1.0	KT-85127 Remove kotlin.test.assert*NoInline hidden functions
2.1.0	KT-71278 Enable Concurrent Mark and Sweep (CMS) GC by default
2.1.0	KT-84826 Bump the minimum deployment version of Apple targets
2.1.0	KT-84615 KJS: Forbid @JsStatic on extension functions/properties
2.1.0	Compose compiler: Started inferring the stability of all interfaces to be Stability.Unknown, except for those explicitly marked as known stable
2.1.0	Compose compiler: Made the default stability of non-final classes Unknown instead of Stable
2.0.0	Open properties with backing fields must be immediately initialized; deferred initialization in init blocks is no longer allowed
2.0.0	Synthetic setters on projected receivers now report errors when assigning types that conflict with the class's projected type
2.0.0	Function literals with inaccessible generic types are now forbidden and trigger compilation errors
2.0.0	Resolution order changed: Kotlin properties in subclasses now consistently take precedence over Java fields with the same name in parent classes
2.0.0	Java primitive arrays now retain native nullability from TYPE_USE annotations, causing errors when values are not used according to annotations
2.0.0	Expected non-abstract classes that inherit abstract functions must now explicitly override them as non-abstract
2.0.0	Property value access before property initialization is now prohibited
2.0.0	Errors are reported when there's ambiguity in imported classes with the same name
2.0.0	If conditions with one branch are forbidden when an expression is required
2.0.0	Violation of self upper bounds by passing star-projection of generic type is now prohibited
2.0.0	Anonymous types from private inline functions are now prohibited from being exposed
2.0.0	Errors are reported for unsound smart casts after while-loop breaks
2.0.0	Upper bound violations in typealias constructors are now prohibited
2.0.0	Unit conversion on arbitrary expressions in invoke operator convention calls is now prohibited
2.0.0	Nullable assignment to non-null Java fields accessed with safe calls is now forbidden
2.0.0	Star-projected type is required when overriding Java methods containing raw-type parameters
2.0.0	Implicit non-public API access in effectively public inline functions is now forbidden
2.0.0	Use-site get annotations on property getters are now prohibited
2.0.0	Special handling for false && ... and false || ... for smart-casting has been removed
2.0.0	Inline open functions in enums are now forbidden
2.0.0	Common and platform sources are now strictly separated during compilation in Kotlin Multiplatform, preventing common code from accessing platform code

All breaking changes by upgrading org.jetbrains.kotlin:kotlin-stdlib-jdk8 from version 1.9.25 to 2.1.0 (CHANGELOG)

Version	Description
2.1.0	KT-85062 Deprecate language version 2.1
2.1.0	KT-79663 KLIB-based compilers: Promote partial linkage to "always on"
2.1.0	KT-76634 PL: Don't report warnings in cases that don't lead to runtime errors
2.1.0	KT-72950 Partial Linkage: Change the semantics of -Xpartial-linkage-loglevel
2.1.0	KT-84714 KJS: Forbid exporting properties with context parameters
2.1.0	KT-84615 KJS: Forbid @JsStatic on extension functions/properties
2.1.0	KT-82122 Prohibit arbitrary placement of type parameters in callable reference LHS
2.1.0	KT-84488 Export in previous version: Prohibit using on 2nd stage
2.1.0	KT-85122 Deprecate kotlin.io.readLine with WARNING
2.1.0	KT-84970 Deprecate AbstractCoroutineContextKey and associated API
2.1.0	KT-84826 Bump the minimum deployment version of Apple targets
2.1.0	KT-71278 Enable Concurrent Mark and Sweep (CMS) GC by default
2.1.0	KT-81433 Generate C-interop KLIBs in previous ABI version in Kotlin 2.4.0
2.1.0	Compose compiler: Started inferring the stability of all interfaces to be Stability.Unknown, except for those explicitly marked as known stable
2.1.0	Compose compiler: Made the default stability of non-final classes Unknown instead of Stable
2.1.0	Compose compiler: Started using Stability.Runtime more broadly. Now, when an element depends on the stability of an internal or public class defined in another file, the element will no longer infer the stability of that class and will depend on the runtime stability of that class instead
2.0.0	Open properties with backing fields must be immediately initialized; deferred initialization in init blocks is no longer allowed
2.0.0	Synthetic setters on projected receivers now report errors when assigning types that conflict with the class's projected type
2.0.0	Function literals with inaccessible generic types are now forbidden and trigger compilation errors
2.0.0	Resolution order changed: Kotlin properties in subclasses now consistently take precedence over Java fields with the same name in parent classes
2.0.0	Java primitive arrays now retain native nullability from TYPE_USE annotations, causing errors when values are not used according to annotations
2.0.0	Expected non-abstract classes that inherit abstract functions must now explicitly override them as non-abstract
2.0.0	Property value access before property initialization is now prohibited
2.0.0	Errors are reported when there's ambiguity in imported classes with the same name
2.0.0	If conditions with one branch are forbidden when an expression is required
2.0.0	Violation of self upper bounds by passing star-projection of generic type is now prohibited
2.0.0	Anonymous types exposure from private inline functions is now prohibited
2.0.0	Unsound smart cast after while-loop break now reports an error
2.0.0	Upper bound violation in typealias constructors is now prohibited
2.0.0	Nullable assignment to non-null Java field when accessed with safe call is now forbidden
2.0.0	Star-projected type is required when overriding Java method containing raw-type parameter
2.0.0	Implicit non-public API access in effectively public inline functions is now forbidden
2.0.0	Use-site get annotations on property getters are now prohibited
2.0.0	Inline open functions in enums are now forbidden
2.0.0	Common and platform sources are now strictly separated during compilation in Kotlin Multiplatform, preventing common code from accessing platform code
2.0.0	Unit conversion on arbitrary expressions in invoke operator convention call is now prohibited
2.0.0	Properties with backing field and custom setter must be immediately initialized
2.0.0	Special handling for false && ... and false || ... for smart-casting has been removed

✅ 20 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-445867	🚨 CRITICAL	[netty-handler] TLS ClientHello parsing vulnerability allows attackers to bypass SNI-based SslContext selection, potentially enabling unauthorized access to protected routes in deployments relying solely on SNI for mutual TLS enforcement without additional certificate validation.
AIKIDO-2026-421700	HIGH	[netty-handler] Hostname verification silently fails on Java 25+ due to unavailable Unsafe reflection, allowing clients to accept certificates for wrong hostnames and enabling man-in-the-middle attacks.
AIKIDO-2026-592216	HIGH	[netty-codec-http2] HTTP/1-to-HTTP/2 conversion incorrectly prioritizes the Host header over request-target authority, allowing attackers to bypass host validation and routing controls through mismatched authority values. This enables host/tenant boundary bypass, cache poisoning, and unintended upstream routing.
AIKIDO-2026-918525	HIGH	[netty-codec-http2] HTTP/1-to-HTTP/2 conversion improperly handles CONNECT requests, using the Host header instead of the request-target for the :authority pseudo-header, enabling request smuggling and tunnel-destination bypass in proxies.
AIKIDO-2026-58442	HIGH	[netty-codec-http2] HTTP/2 Extended CONNECT requests are improperly downgraded to plain CONNECT tunnels, dropping protocol and path metadata that downstream handlers use for routing and authorization, allowing security policies to be bypassed.
AIKIDO-2026-453463	LOW	[netty-codec-http2] HTTP/2 header values lack validation by default, allowing prohibited octets (NUL, CR, LF) to pass through, enabling request smuggling and response splitting when translated to HTTP/1.1 by proxies or gateways.
AIKIDO-2026-275094	LOW	[netty-codec-http2] Remote clients can send HTTP/2 SETTINGS frames with extremely large header-table sizes, causing the encoder to retain headers indefinitely and degrade to O(n²) lookups, resulting in denial of service through throughput collapse.
AIKIDO-2026-240696	HIGH	[netty-codec-socks] SOCKS4/5 encoders fail to reject null bytes and CRLF in domain, userid, and credential fields, enabling hostname spoofing, authentication bypass, and connection redirection to unintended targets.
AIKIDO-2026-664762	HIGH	[netty-codec-http] Multiple HTTP codec vulnerabilities enable denial-of-service attacks through unbounded queues and memory exhaustion, plus request smuggling via improper chunk-extension and Transfer-Encoding validation. Fixes add bounds checking and stricter validation.
AIKIDO-2026-179204	HIGH	[netty-codec-http] HTTP request/response pairing logic incorrectly matches 1xx interim responses to pipelined requests, causing response bodies to be misrouted and enabling HTTP response splitting and smuggling attacks.
AIKIDO-2026-11158	HIGH	[spring-core] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
AIKIDO-2026-620042	LOW	[spring-core] A vulnerability allows CR/LF characters from untrusted file names to be embedded in HTTP response headers or multipart content, potentially enabling HTTP response splitting attacks. The patch sanitizes file names used in Content-Disposition headers to prevent this injection.
AIKIDO-2026-980617	MEDIUM	[reactor-netty-http] A WebSocket handshake redirect to a different origin can leak credentials when the HTTP client is configured to follow redirects, allowing a remote attacker to intercept credentials meant for the original host.
AIKIDO-2026-718872	MEDIUM	[reactor-netty-http] A vulnerability allows incorrect evaluation of remote IP addresses when HAProxy Protocol is enabled, potentially leading to access-control bypass or incorrect logging based on wrong client identity. This impacts security decisions that rely on the client's IP address.
AIKIDO-2026-556582	LOW	[reactor-netty-http] A remote attacker can cause excessive memory consumption by sending HTTP/1.1 pipelined requests on a single connection, leading to denial of service and reduced server availability. The vulnerability allows degradation or exhaustion of server resources through memory exhaustion.
AIKIDO-2026-268979	MEDIUM	[reactor-core] A 20-bit index wrap in Flux.windowTimeout with fair backpressure can cause the operator to hang indefinitely on long-lived streams, allowing attackers to exhaust resources through denial of service.
AIKIDO-2026-224455	MEDIUM	[reactor-core] A race condition in Flux.bufferTimeout with fair backpressure can cause the stream to hang when upstream items arrive during buffer flushing, leaving items unprocessed. An attacker can exploit this to exhaust subscriptions, resulting in denial of service.
AIKIDO-2026-349640	MEDIUM	[spring-beans] A data binding vulnerability allows untrusted property paths to trigger unbounded memory allocation through lists that grow on access, bypassing the autoGrowCollectionLimit protection and potentially causing denial of service through memory exhaustion.
AIKIDO-2026-550292	MEDIUM	[kotlin-stdlib] In JetBrains Kotlin, a vulnerable Java API is used for temporary file and folder creation. An attacker is able to read data from such files and list directories due to insecure permissions.
AIKIDO-2026-592409	LOW	[reactor-netty-core] A DNS resolver configuration can be incorrectly reused across multiple dynamically created clients with different resolver settings, causing traffic to be routed to unintended destinations. This allows an attacker to perform DNS hijacking or traffic redirection attacks.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-19103
• https://aikido.atlassian.net/browse/AIK-20111

🤖 Remediation details

Fix transitive Netty, Reactor, Spring Framework, and Kotlin stdlib vulnerabilities

This PR remediates security vulnerabilities in io.netty:netty-handler, io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-socks, io.projectreactor.netty:reactor-netty-http, io.projectreactor.netty:reactor-netty-core, io.projectreactor:reactor-core, org.springframework:spring-web, org.springframework:spring-beans, org.springframework:spring-core, org.jetbrains.kotlin:kotlin-stdlib, org.jetbrains.kotlin:kotlin-stdlib-jdk7, and org.jetbrains.kotlin:kotlin-stdlib-jdk8. All affected artifacts were resolved transitively through three compileOnly direct dependencies declared in agent/build.gradle. Fixes were applied by bumping those three direct dependencies and raising the project-wide Java compatibility target in the root build.gradle.

io.netty:netty-handler

netty-handler was resolved transitively at 4.1.115.Final through the direct dependency io.projectreactor.netty:reactor-netty-http:1.2.1. Bumping reactor-netty-http to 1.3.7 in agent/build.gradle causes Gradle to resolve netty-handler at 4.2.17.Final, which satisfies the ≥ 4.1.137.Final patched floor. No direct pin was needed.

io.netty:netty-codec-http

netty-codec-http was resolved transitively at 4.1.115.Final via reactor-netty-http:1.2.1. The same parent bump to reactor-netty-http:1.3.7 resolves netty-codec-http to 4.2.17.Final, meeting the ≥ 4.1.137.Final requirement.

io.netty:netty-codec-http2

netty-codec-http2 was resolved transitively at 4.1.115.Final via reactor-netty-http:1.2.1. Bumping reactor-netty-http to 1.3.7 resolves netty-codec-http2 to 4.2.17.Final, satisfying the ≥ 4.1.138.Final patched floor.

io.netty:netty-codec-socks

netty-codec-socks was resolved transitively at 4.1.115.Final through reactor-netty-core:1.2.1, which is itself a transitive of reactor-netty-http:1.2.1. Bumping reactor-netty-http to 1.3.7 pulls in reactor-netty-core:1.3.7, which resolves netty-codec-socks to 4.2.17.Final, meeting the ≥ 4.1.137.Final requirement.

io.projectreactor.netty:reactor-netty-http

reactor-netty-http was declared directly in agent/build.gradle at 1.2.1. It was bumped to 1.3.7 — the smallest release that transitively resolves all affected Netty artifacts, reactor-netty-core, and reactor-core to their respective patched floors.

io.projectreactor.netty:reactor-netty-core

reactor-netty-core was resolved transitively at 1.2.1 as a dependency of reactor-netty-http:1.2.1. Bumping reactor-netty-http to 1.3.7 brings reactor-netty-core to 1.3.7, satisfying the ≥ 1.3.7 patched floor.

io.projectreactor:reactor-core

reactor-core was resolved transitively at 3.7.1 through reactor-netty-core:1.2.1. The bump of reactor-netty-http to 1.3.7 causes reactor-netty-core:1.3.7 to pull in reactor-core:3.8.7, meeting the ≥ 3.8.7 requirement.

org.springframework:spring-web

spring-web was declared directly in agent/build.gradle at 5.3.20. It was bumped to 6.2.19, the smallest Spring 6.x release that patches the affected vulnerability range (≥ 5.3.0 ≤ 6.2.18). Spring Framework 6.x requires a minimum JVM runtime of 17, so the project-wide sourceCompatibility/targetCompatibility in the root build.gradle was raised from VERSION_16 to VERSION_17 accordingly; Java 21 is available in this environment. Upgrading to 7.0.9 was not possible without source-level changes because the project calls ServerHttpResponse.getRawStatusCode(), an API removed in Spring 7.x.

org.springframework:spring-beans

spring-beans was resolved transitively at 5.3.20 as a dependency of spring-web:5.3.20. Bumping spring-web to 6.2.19 resolves spring-beans to 6.2.19. The full 7.0.9 target was blocked by the same source-level API incompatibility described under spring-web.

org.springframework:spring-core

spring-core was resolved transitively at 5.3.20 through spring-web:5.3.20. The bump of spring-web to 6.2.19 resolves spring-core to 6.2.19, which is the patched version for the Spring Framework vulnerability chain.

org.jetbrains.kotlin:kotlin-stdlib

kotlin-stdlib was resolved transitively at 1.9.25 through io.javalin:javalin:6.4.0. Bumping javalin to 7.0.0 in agent/build.gradle causes the kotlin-stdlib-jdk7/jdk8 split artifacts to be dropped entirely by the Javalin 7.x dependency graph, and kotlin-stdlib:2.2.20 is resolved instead — well above the ≥ 2.1.0 patched floor.

org.jetbrains.kotlin:kotlin-stdlib-jdk7

kotlin-stdlib-jdk7 was resolved transitively at 1.9.25 via javalin:6.4.0 → kotlin-stdlib-jdk8:1.9.25. The bump of javalin to 7.0.0 removes this artifact from the resolved dependency graph entirely, eliminating the vulnerability.

org.jetbrains.kotlin:kotlin-stdlib-jdk8

kotlin-stdlib-jdk8 was resolved transitively at 1.9.25 as a direct dependency of javalin:6.4.0. The bump of javalin to 7.0.0 removes this artifact from the resolved graph, eliminating the vulnerability.

Version changes

Package	From	To	Why updated
io.projectreactor.netty:reactor-netty-http	1.2.1	1.3.7	Direct CVE fix; parent bump to resolve all transitive Netty, reactor-netty-core, and reactor-core vulnerabilities
io.projectreactor.netty:reactor-netty-core	1.2.1	1.3.7	Transitive after parent bump (reactor-netty-http:1.3.7)
io.projectreactor:reactor-core	3.7.1	3.8.7	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-handler	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-codec-http	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-codec-http2	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-codec-socks	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7 → reactor-netty-core:1.3.7)
io.netty:netty-common	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-buffer	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-transport	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-resolver	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http:1.3.7)
io.netty:netty-codec	4.1.115.Final	— (removed)	Replaced by netty-codec-base in Netty 4.2.x after parent bump
org.springframework:spring-web	5.3.20	6.2.19	Direct CVE fix
org.springframework:spring-beans	5.3.20	6.2.19	Transitive after parent bump (spring-web:6.2.19)
org.springframework:spring-core	5.3.20	6.2.19	Transitive after parent bump (spring-web:6.2.19)
io.javalin:javalin	6.4.0	7.0.0	Direct bump to remove vulnerable kotlin-stdlib-jdk7/jdk8 transitives
org.jetbrains.kotlin:kotlin-stdlib	1.9.25	2.2.20	Transitive after parent bump (javalin:7.0.0)
org.jetbrains.kotlin:kotlin-stdlib-jdk7	1.9.25	— (removed)	Removed from graph after parent bump (javalin:7.0.0)
org.jetbrains.kotlin:kotlin-stdlib-jdk8	1.9.25	— (removed)	Removed from graph after parent bump (javalin:7.0.0)

[aikido-pr-checks]

2 Open source vulnerabilities detected - medium severity
Aikido detected 2 vulnerabilities across 2 packages, it includes 2 medium vulnerabilities.

Details

Remediation:

• Eclipse Jetty — 1 CVE (medium) — fixed in 12.1.10
• org.eclipse.jetty:jetty-util — 1 CVE (medium) — fixed in 12.1.9

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!