azure-core-http-netty:1.6.12 CVE-2025-67735

[Bill-zy]

When will Azure SDK be updated for vulnerability CVE-2025-67735?
https://www.cve.org/CVERecord?id=CVE-2025-67735

[samvaity]

@alzimmermsft Do you know if we are already looking into this ?

[petarov]

I was also looking into this, but I see azure-core-http-netty still uses Netty 4.1.127.Final in azure-identity:1.18.1.

https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/core/azure-core-http-netty/pom.xml#L67

[alzimmermsft]

There is an open PR for upgrading the Netty dependencies we're using:

#47611