Netty fixes QUIC close race that could drop CONNECTION_CLOSE frames
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Jun 12, 2026
Netty fixed a QUIC race condition in QuicheQuicChannel that could notify a close promise before pending writes had completed, allowing a parent socket to close while data was still in flight. In affected cases, especially with pending SENDMSG operations on io_uring, the remote peer could miss the QUIC CONNECTION_CLOSE frame, leading to improper connection shutdown behavior.
The fix, tracked under issue #16718 and merged through pull request #16758, changes shutdown handling to ensure writes finish before close notification is delivered. Netty also added a unit test that simulates delayed writes and the raced close path, and shipped the correction in Netty 4.2.14.Final; downstream projects including ArcadeDB subsequently updated dependencies to consume the patched release.
