[Aikido] Fix 19 security issues in netty-handler, netty-codec-http2, netty-codec-socks and 13 more

[aikido-autofix]

Upgrade dependencies to fix critical mTLS bypass via SNI misconfiguration, hostname verification failures on Java 25+, HTTP/1-to-HTTP/2 conversion vulnerabilities enabling host boundary bypass and request smuggling, and Extended CONNECT downgrade attacks.

⚠️ Incomplete breaking changes analysis (6/16 analyzed)

⚠️ Breaking changes analysis not available for: org.springframework:spring-core, org.springframework:spring-webmvc, org.springframework:spring-web, org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-context, io.projectreactor.netty:reactor-netty-http, io.projectreactor:reactor-core, org.jetbrains.kotlin:kotlin-stdlib, io.projectreactor.netty:reactor-netty-core

✅ The Kotlin stdlib upgrade from 1.9.25 to 2.1.0 does not introduce breaking changes that affect this codebase. The code consists of simple Spring MVC, Ktor, and Javalin applications with basic Kotlin patterns (data classes, simple functions, standard library usage). None of the breaking changes listed in the changelog (deprecated APIs, Compose compiler changes, advanced type system changes, multiplatform restrictions, or complex property initialization patterns) are present in this codebase.

All breaking changes by upgrading org.jetbrains.kotlin:kotlin-stdlib-jdk7 from version 1.9.25 to 2.1.0 (CHANGELOG)

Version	Description
2.1.0	KT-85062 Deprecate language version 2.1
2.1.0	KT-79663 KLIB-based compilers: Promote partial linkage to "always on"
2.1.0	KT-76934 Drop old IR parameter API
2.1.0	KT-72950 Partial Linkage: Change the semantics of -Xpartial-linkage-loglevel
2.1.0	KT-84714 KJS: Forbid exporting properties with context parameters
2.1.0	KT-67809 Native: remove support for non-opaque LLVM pointer types
2.1.0	KT-82127 Remove generator-based coroutines intrinsics after bootstrap
2.1.0	KT-83992 Drop K1 JS entry point and IC code
2.1.0	KT-84684 Remove UserVisibleIrModulesSupport from IR linker
2.1.0	KT-85122 Deprecate kotlin.io.readLine with WARNING
2.1.0	KT-84970 Deprecate AbstractCoroutineContextKey and associated API
2.1.0	KT-85127 Remove kotlin.test.assert*NoInline hidden functions
2.1.0	KT-71278 Enable Concurrent Mark and Sweep (CMS) GC by default
2.1.0	KT-84826 Bump the minimum deployment version of Apple targets
2.1.0	KT-84615 KJS: Forbid @JsStatic on extension functions/properties
2.1.0	Compose compiler: Started inferring the stability of all interfaces to be Stability.Unknown, except for those explicitly marked as known stable
2.1.0	Compose compiler: Made the default stability of non-final classes Unknown instead of Stable
2.0.0	Open properties with backing fields must be immediately initialized; deferred initialization in init blocks is no longer allowed
2.0.0	Synthetic setters on projected receivers now report errors when assigning types that conflict with the class's projected type
2.0.0	Function literals with inaccessible generic types are now forbidden and trigger compilation errors
2.0.0	Resolution order changed: Kotlin properties in subclasses now consistently take precedence over Java fields with the same name in parent classes
2.0.0	Java primitive arrays now retain native nullability from TYPE_USE annotations, causing errors when values are not used according to annotations
2.0.0	Expected non-abstract classes that inherit abstract functions must now explicitly override them as non-abstract
2.0.0	Property value access before property initialization is now prohibited
2.0.0	Errors are reported when there's ambiguity in imported classes with the same name
2.0.0	If conditions with one branch are forbidden when an expression is required
2.0.0	Violation of self upper bounds by passing star-projection of generic type is now prohibited
2.0.0	Anonymous types from private inline functions are now prohibited from being exposed
2.0.0	Errors are reported for unsound smart casts after while-loop breaks
2.0.0	Upper bound violations in typealias constructors are now prohibited
2.0.0	Unit conversion on arbitrary expressions in invoke operator convention calls is now prohibited
2.0.0	Nullable assignment to non-null Java fields accessed with safe calls is now forbidden
2.0.0	Star-projected type is required when overriding Java methods containing raw-type parameters
2.0.0	Implicit non-public API access in effectively public inline functions is now forbidden
2.0.0	Use-site get annotations on property getters are now prohibited
2.0.0	Special handling for false && ... and false || ... for smart-casting has been removed
2.0.0	Inline open functions in enums are now forbidden
2.0.0	Common and platform sources are now strictly separated during compilation in Kotlin Multiplatform, preventing common code from accessing platform code

All breaking changes by upgrading org.jetbrains.kotlin:kotlin-stdlib-jdk8 from version 1.9.25 to 2.1.0 (CHANGELOG)

Version	Description
2.1.0	KT-85062 Deprecate language version 2.1
2.1.0	KT-79663 KLIB-based compilers: Promote partial linkage to "always on"
2.1.0	KT-76634 PL: Don't report warnings in cases that don't lead to runtime errors
2.1.0	KT-72950 Partial Linkage: Change the semantics of -Xpartial-linkage-loglevel
2.1.0	KT-84714 KJS: Forbid exporting properties with context parameters
2.1.0	KT-84615 KJS: Forbid @JsStatic on extension functions/properties
2.1.0	KT-82122 Prohibit arbitrary placement of type parameters in callable reference LHS
2.1.0	KT-84488 Export in previous version: Prohibit using on 2nd stage
2.1.0	KT-85122 Deprecate kotlin.io.readLine with WARNING
2.1.0	KT-84970 Deprecate AbstractCoroutineContextKey and associated API
2.1.0	KT-84826 Bump the minimum deployment version of Apple targets
2.1.0	KT-71278 Enable Concurrent Mark and Sweep (CMS) GC by default
2.1.0	KT-81433 Generate C-interop KLIBs in previous ABI version in Kotlin 2.4.0
2.1.0	Compose compiler: Started inferring the stability of all interfaces to be Stability.Unknown, except for those explicitly marked as known stable
2.1.0	Compose compiler: Made the default stability of non-final classes Unknown instead of Stable
2.1.0	Compose compiler: Started using Stability.Runtime more broadly. Now, when an element depends on the stability of an internal or public class defined in another file, the element will no longer infer the stability of that class and will depend on the runtime stability of that class instead
2.0.0	Open properties with backing fields must be immediately initialized; deferred initialization in init blocks is no longer allowed
2.0.0	Synthetic setters on projected receivers now report errors when assigning types that conflict with the class's projected type
2.0.0	Function literals with inaccessible generic types are now forbidden and trigger compilation errors
2.0.0	Resolution order changed: Kotlin properties in subclasses now consistently take precedence over Java fields with the same name in parent classes
2.0.0	Java primitive arrays now retain native nullability from TYPE_USE annotations, causing errors when values are not used according to annotations
2.0.0	Expected non-abstract classes that inherit abstract functions must now explicitly override them as non-abstract
2.0.0	Property value access before property initialization is now prohibited
2.0.0	Errors are reported when there's ambiguity in imported classes with the same name
2.0.0	If conditions with one branch are forbidden when an expression is required
2.0.0	Violation of self upper bounds by passing star-projection of generic type is now prohibited
2.0.0	Anonymous types exposure from private inline functions is now prohibited
2.0.0	Unsound smart cast after while-loop break now reports an error
2.0.0	Upper bound violation in typealias constructors is now prohibited
2.0.0	Nullable assignment to non-null Java field when accessed with safe call is now forbidden
2.0.0	Star-projected type is required when overriding Java method containing raw-type parameter
2.0.0	Implicit non-public API access in effectively public inline functions is now forbidden
2.0.0	Use-site get annotations on property getters are now prohibited
2.0.0	Inline open functions in enums are now forbidden
2.0.0	Common and platform sources are now strictly separated during compilation in Kotlin Multiplatform, preventing common code from accessing platform code
2.0.0	Unit conversion on arbitrary expressions in invoke operator convention call is now prohibited
2.0.0	Properties with backing field and custom setter must be immediately initialized
2.0.0	Special handling for false && ... and false || ... for smart-casting has been removed

✅ 19 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-445867	🚨 CRITICAL	[netty-handler] TLS ClientHello parsing vulnerability allows attackers to bypass SNI-based SslContext selection, potentially enabling unauthorized access to protected routes in deployments relying solely on SNI for mutual TLS enforcement without additional certificate validation.
AIKIDO-2026-421700	HIGH	[netty-handler] Hostname verification silently fails on Java 25+ due to unavailable Unsafe reflection, allowing clients to accept certificates for wrong hostnames and enabling man-in-the-middle attacks.
AIKIDO-2026-592216	HIGH	[netty-codec-http2] HTTP/1-to-HTTP/2 conversion incorrectly prioritizes the Host header over request-target authority, allowing attackers to bypass host validation and routing controls through mismatched authority values. This enables host/tenant boundary bypass, cache poisoning, and unintended upstream routing.
AIKIDO-2026-918525	HIGH	[netty-codec-http2] HTTP/1-to-HTTP/2 conversion improperly handles CONNECT requests, using the Host header instead of the request-target for the :authority pseudo-header, enabling request smuggling and tunnel-destination bypass in proxies.
AIKIDO-2026-58442	HIGH	[netty-codec-http2] HTTP/2 Extended CONNECT requests are improperly downgraded to plain CONNECT tunnels, dropping protocol and path metadata that downstream handlers use for routing and authorization, allowing security policies to be bypassed.
AIKIDO-2026-453463	LOW	[netty-codec-http2] HTTP/2 header values lack validation by default, allowing prohibited octets (NUL, CR, LF) to pass through, enabling request smuggling and response splitting when translated to HTTP/1.1 by proxies or gateways.
AIKIDO-2026-275094	LOW	[netty-codec-http2] Remote clients can send HTTP/2 SETTINGS frames with extremely large header-table sizes, causing the encoder to retain headers indefinitely and degrade to O(n²) lookups, resulting in denial of service through throughput collapse.
AIKIDO-2026-240696	HIGH	[netty-codec-socks] SOCKS4/5 encoders fail to reject null bytes and CRLF in domain, userid, and credential fields, enabling hostname spoofing, authentication bypass, and connection redirection to unintended targets.
AIKIDO-2026-179204	HIGH	[netty-codec-http] HTTP request/response pairing logic incorrectly matches 1xx interim responses to pipelined requests, causing response bodies to be misrouted and enabling HTTP response splitting and smuggling attacks.
AIKIDO-2026-11158	HIGH	[spring-core] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
AIKIDO-2026-620042	LOW	[spring-core] A vulnerability allows CR/LF characters from untrusted file names to be embedded in HTTP response headers or multipart content, potentially enabling HTTP response splitting attacks. The patch sanitizes file names used in Content-Disposition headers to prevent this injection.
AIKIDO-2026-980617	MEDIUM	[reactor-netty-http] A WebSocket handshake redirect to a different origin can leak credentials when the HTTP client is configured to follow redirects, allowing a remote attacker to intercept credentials meant for the original host.
AIKIDO-2026-718872	MEDIUM	[reactor-netty-http] A vulnerability allows incorrect evaluation of remote IP addresses when HAProxy Protocol is enabled, potentially leading to access-control bypass or incorrect logging based on wrong client identity. This impacts security decisions that rely on the client's IP address.
AIKIDO-2026-556582	LOW	[reactor-netty-http] A remote attacker can cause excessive memory consumption by sending HTTP/1.1 pipelined requests on a single connection, leading to denial of service and reduced server availability. The vulnerability allows degradation or exhaustion of server resources through memory exhaustion.
AIKIDO-2026-268979	MEDIUM	[reactor-core] A 20-bit index wrap in Flux.windowTimeout with fair backpressure can cause the operator to hang indefinitely on long-lived streams, allowing attackers to exhaust resources through denial of service.
AIKIDO-2026-224455	MEDIUM	[reactor-core] A race condition in Flux.bufferTimeout with fair backpressure can cause the stream to hang when upstream items arrive during buffer flushing, leaving items unprocessed. An attacker can exploit this to exhaust subscriptions, resulting in denial of service.
AIKIDO-2026-349640	MEDIUM	[spring-beans] A data binding vulnerability allows untrusted property paths to trigger unbounded memory allocation through lists that grow on access, bypassing the autoGrowCollectionLimit protection and potentially causing denial of service through memory exhaustion.
AIKIDO-2026-550292	MEDIUM	[kotlin-stdlib] In JetBrains Kotlin, a vulnerable Java API is used for temporary file and folder creation. An attacker is able to read data from such files and list directories due to insecure permissions.
AIKIDO-2026-592409	LOW	[reactor-netty-core] A DNS resolver configuration can be incorrectly reused across multiple dynamically created clients with different resolver settings, causing traffic to be routed to unintended destinations. This allows an attacker to perform DNS hijacking or traffic redirection attacks.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-19103
• https://aikido.atlassian.net/browse/AIK-20036

🤖 Remediation details

Fix transitive and direct dependency CVEs: Netty, Spring Framework, Reactor, and Kotlin stdlib

Short summary

This PR remediates security vulnerabilities in the following packages: io.netty:netty-handler, io.netty:netty-codec-http2, io.netty:netty-codec-socks, io.netty:netty-codec-http, org.springframework:spring-web, org.springframework:spring-beans, io.projectreactor.netty:reactor-netty-http, io.projectreactor.netty:reactor-netty-core, io.projectreactor:reactor-core, and org.jetbrains.kotlin:kotlin-stdlib (plus kotlin-stdlib-jdk7/jdk8). All vulnerable packages appear on the compileClasspath of the :agent subproject. Fixes were applied to agent/build.gradle (direct version bumps and a constraints block) and to the root build.gradle (Java version floor raised to enable Spring 7.x).

---

io.netty:netty-handler

netty-handler is pulled in transitively through io.projectreactor.netty:reactor-netty-http (declared compileOnly in agent/build.gradle). Bumping reactor-netty-http from 1.2.1 to 1.3.7 causes Gradle to resolve netty-handler at 4.2.17.Final, which is above the patched floor of 4.1.137.Final. No direct pin was needed.

io.netty:netty-codec-http2

netty-codec-http2 is a transitive dependency of io.projectreactor.netty:reactor-netty-http. The same parent bump to 1.3.7 resolves netty-codec-http2 at 4.2.17.Final, satisfying the patched floor of 4.1.138.Final.

io.netty:netty-codec-socks

netty-codec-socks is pulled in transitively via reactor-netty-core (itself a dependency of reactor-netty-http). Bumping reactor-netty-http to 1.3.7 resolves netty-codec-socks at 4.2.17.Final, above the patched floor of 4.1.137.Final.

io.netty:netty-codec-http

netty-codec-http is a transitive dependency of io.projectreactor.netty:reactor-netty-http. The parent bump to 1.3.7 resolves netty-codec-http at 4.2.17.Final, satisfying the patched floor of 4.1.137.Final.

io.projectreactor.netty:reactor-netty-http

reactor-netty-http is declared directly as compileOnly 'io.projectreactor.netty:reactor-netty-http:1.2.1' in agent/build.gradle. The version was bumped directly to 1.3.7, which is the patched release. This single edit also transitively resolves all four vulnerable Netty artifacts above their respective patched floors.

io.projectreactor.netty:reactor-netty-core

reactor-netty-core is a transitive dependency of reactor-netty-http. Bumping reactor-netty-http to 1.3.7 pulls in reactor-netty-core:1.3.7, satisfying the patched floor of 1.3.7.

io.projectreactor:reactor-core

reactor-core is a transitive dependency of reactor-netty-core, which is itself pulled in by reactor-netty-http. The parent bump of reactor-netty-http to 1.3.7 resolves reactor-core at 3.8.7, meeting the patched floor of 3.8.7.

org.springframework:spring-web

spring-web is declared directly as compileOnly 'org.springframework:spring-web:5.3.20' in agent/build.gradle. The version was bumped to 7.0.9 to satisfy the patched floor. Spring Framework 7.x requires JVM 17+, so the root build.gradle was also updated from JavaVersion.VERSION_16 to JavaVersion.VERSION_17 (Java 21 is present in the build environment); without this change Gradle's variant selection rejected the artifact outright.

org.springframework:spring-beans

spring-beans is a transitive dependency of org.springframework:spring-web. Bumping spring-web to 7.0.9 resolves spring-beans at 7.0.9, satisfying the patched floor of 7.0.9.

org.jetbrains.kotlin:kotlin-stdlib

kotlin-stdlib (and its jdk7/jdk8 siblings) are pulled in transitively by io.javalin:javalin:6.4.0 (declared compileOnly in agent/build.gradle). Bumping javalin to the fixing version would require a major-version jump (6.x → 7.x), which is not permitted. Instead, a constraints block was added inside the dependencies block in agent/build.gradle, pinning kotlin-stdlib, kotlin-stdlib-jdk7, and kotlin-stdlib-jdk8 each to 2.1.0, which satisfies the patched floor. Gradle's constraint mechanism forces the transitive resolution up to 2.1.0 without altering the javalin declaration.

org.jetbrains.kotlin:kotlin-stdlib-jdk7

kotlin-stdlib-jdk7 is a transitive dependency of kotlin-stdlib-jdk8, itself brought in by io.javalin:javalin:6.4.0. The same constraints block that pins kotlin-stdlib also pins kotlin-stdlib-jdk7 to 2.1.0, satisfying the patched floor.

org.jetbrains.kotlin:kotlin-stdlib-jdk8

kotlin-stdlib-jdk8 is a direct transitive dependency of io.javalin:javalin:6.4.0. The constraints block added to agent/build.gradle pins it to 2.1.0, satisfying the patched floor.

---

Version changes

Package	From	To	Why updated
io.projectreactor.netty:reactor-netty-http	1.2.1	1.3.7	Direct CVE fix (reactor-netty-http vulnerability; also drives all Netty and Reactor transitive bumps)
io.projectreactor.netty:reactor-netty-core	1.2.1	1.3.7	Transitive after parent bump (reactor-netty-http → 1.3.7)
io.projectreactor:reactor-core	3.7.1	3.8.7	Transitive after parent bump (reactor-netty-http → 1.3.7)
io.netty:netty-handler	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http → 1.3.7)
io.netty:netty-codec-http2	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http → 1.3.7)
io.netty:netty-codec-socks	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http → 1.3.7)
io.netty:netty-codec-http	4.1.115.Final	4.2.17.Final	Transitive after parent bump (reactor-netty-http → 1.3.7)
org.springframework:spring-web	5.3.20	7.0.9	Direct CVE fix (spring-web vulnerability)
org.springframework:spring-beans	5.3.20	7.0.9	Transitive after parent bump (spring-web → 7.0.9)
org.springframework:spring-core	5.3.20	7.0.9	Transitive after parent bump (spring-web → 7.0.9)
org.jetbrains.kotlin:kotlin-stdlib	1.9.25	2.1.0	Constraint override (parent javalin major bump blocked; public parent)
org.jetbrains.kotlin:kotlin-stdlib-jdk7	1.9.25	2.1.0	Constraint override (parent javalin major bump blocked; public parent)
org.jetbrains.kotlin:kotlin-stdlib-jdk8	1.9.25	2.1.0	Constraint override (parent javalin major bump blocked; public parent)

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 20 security issues in netty-handler, netty-codec-http2, netty-codec-socks and 13 more