Bump to Vert.x 4.5.13 and Netty 4.1.118.Final

[jponge]

See https://github.com/vert-x3/wiki/wiki/4.5.13-Release-Notes

Fixes the following CVEs:

• CVE-2025-24970
• CVE-2025-25193

[sberyozkin]

Hi @jponge Can it be backported to 3.15, and 3.8 ?

[jponge]

I need to have a look, it depends on what the Netty versions are here as Netty has been quite brittle wrt native compilation in their minor upgrades.

[jponge]

3.15 looks easy to do, but I will open a PR instead of just tagging with a backport label (/cc @gsmet)

Next I'll look at 3.8

[jponge]

Update: I was on the wrong reference branch for 3.15, so I need to restart the investigations for 3.15

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit c07461a.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

---

Flaky tests - Develocity

⚙️ JVM Tests - JDK 21

📦 extensions/opentelemetry/deployment

✖ io.quarkus.opentelemetry.deployment.logs.LoggingFrameworkTest.testLog4jLogging - History

• Expected log to have body <ValueString{Log4j Logging message}> but was <ValueString{RESTEASY004687: Closing a class org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine$CleanupAction instance for you. Please close clients yourself.}> - org.opentest4j.AssertionFailedError

org.opentest4j.AssertionFailedError: Expected log to have body <ValueString{Log4j Logging message}> but was <ValueString{RESTEASY004687: Closing a class org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine$CleanupAction instance for you. Please close clients yourself.}>
	at io.quarkus.opentelemetry.deployment.logs.LoggingFrameworkTest.testLog4jLogging(LoggingFrameworkTest.java:95)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:513)
	at io.quarkus.test.QuarkusUnitTest.interceptTestMethod(QuarkusUnitTest.java:427)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)

---

⚙️ JVM Tests - JDK 17 Windows

📦 independent-projects/resteasy-reactive/server/vertx

✖ org.jboss.resteasy.reactive.server.vertx.test.sse.SseServerTestCase.shouldNotTryToSendToClosedSink - History

• 1 expectation failed. Response body doesn't match expectation. Expected: "true" Actual: false - java.lang.AssertionError

java.lang.AssertionError: 
1 expectation failed.
Response body doesn't match expectation.
Expected: "true"
  Actual: false

	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77)

---

⚙️ Maven Tests - JDK 17

📦 integration-tests/devmode

✖ io.quarkus.test.devui.DevUIGrpcSmokeTest.testTestService - History

• Too many recursions, message not returned for id [1755293867] - java.lang.RuntimeException

java.lang.RuntimeException: Too many recursions, message not returned for id [1755293867]
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:164)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)

• Too many recursions, message not returned for id [332609786] - java.lang.RuntimeException

java.lang.RuntimeException: Too many recursions, message not returned for id [332609786]
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:164)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)

[matzew]

Will this be also included in next 3.18 ?

[geoand]

Yes, that's the purpose of the triage/backport label.

[gsmet]

@jponge are we using the native SSL engine by default? I.e. are we practically exposed to this CVE?

[jponge]

@gsmet I think @geoand knows better

[geoand]

I am not sure what they mean in the CVE by "native" SSL engine, but just looking at the code in Netty that fixes it, I would say we are using it

[jponge]

3.8 is more complicated, because meanwhile Netty has had internal refactorings that break native compilation. I might need to also bump Vert.x and backport fixes here.

[gsmet]

@jponge what I usually recommend is to go through the existing Netty upgrade pull requests.

[gsmet]

/cc @sberyozkin @jmartisk for awareness.

[jponge]

Backports:

• 3.15: [3.15] Bump to Netty 4.1.118.Final #46199
• 3.8: [3.8] Bump to Netty 4.1.118.Final #46209

[sberyozkin]

Thanks @jponge for also providing fixes for 3.15 and 3.8 branches