From 054e7af8ccdea71209e545cdca398db8ede42ab1 Mon Sep 17 00:00:00 2001
From: Chaitanya Bhorade <bhoradc@amazon.com>
Date: Mon, 10 Aug 2026 10:40:47 -0700
Subject: [PATCH] Update Netty to 4.1.137

Addresses CVE-2026-59903. Fixes #7242
---
 .changes/next-release/feature-AWSSDKforJavav2-62ef882.json | 6 ++++++
 pom.xml                                                    | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 .changes/next-release/feature-AWSSDKforJavav2-62ef882.json

diff --git a/.changes/next-release/feature-AWSSDKforJavav2-62ef882.json b/.changes/next-release/feature-AWSSDKforJavav2-62ef882.json
new file mode 100644
index 000000000000..4df6739781da
--- /dev/null
+++ b/.changes/next-release/feature-AWSSDKforJavav2-62ef882.json
@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "AWS SDK for Java v2",
+    "contributor": "",
+    "description": "Update Netty to 4.1.137"
+}
diff --git a/pom.xml b/pom.xml
index 6ad56ee71789..3344a6827148 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,7 +119,7 @@
         <equalsverifier.version>3.15.1</equalsverifier.version>
         <!-- Update netty-open-ssl-version accordingly whenever we update netty version-->
         <!-- https://github.com/netty/netty/blob/4.1/pom.xml search "tcnative.version" -->
-        <netty.version>4.1.136.Final</netty.version>
+        <netty.version>4.1.137.Final</netty.version>
         <unitils.version>3.4.6</unitils.version>
         <xmlunit.version>1.3</xmlunit.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -144,7 +144,7 @@
         <jimfs.version>1.1</jimfs.version>
         <testng.version>7.1.0</testng.version> <!-- TCK Tests -->
         <commons-lang.verson>2.6</commons-lang.verson>
-        <netty-open-ssl-version>2.0.78.Final</netty-open-ssl-version>
+        <netty-open-ssl-version>2.0.81.Final</netty-open-ssl-version>
         <dynamodb-local.version>1.25.0</dynamodb-local.version>
         <sqllite.version>1.0.392</sqllite.version>
         <blockhound.version>1.0.16.RELEASE</blockhound.version>