Newest version of metabase docker (v0.63.2.2) does not fix netty vulnerabilities detected in our pipeline

Get Help
1

Hi all,

For my org, I've been charged with patching vulnerabilities of our metabase instance detected in our CI/CD pipeline. Most were fixed when we went from v0.50.21.4 -> v0.63.2.2. However we're still getting a few vulnerabilities labeled "high" and these must be fixed in order for deployment to complete successfully.

For additional context, our metabase instance is hosted in a repo that contains a wrapper dockerfile that pulls the metabase image, we are not storing any of the official source code from github.

The CVEs:

CVE | Package name | Installed package version | Fixed in: version

  1. (HIGH) CVE-2026-59901 | io.netty_netty_codec_compression | 4.2.15.Final | 4.2.16.Final
  2. (HIGH) CVE-2026-56745 | io.netty_netty_codec_http | 4.1.135.Final | 4.2.16.Final, 4.1.136.Final
  3. (HIGH) CVE-2026-55833 | io.netty_netty_codec_http | 4.1.135.Final | 4.2.16.Final, 4.1.136.Final
  4. (HIGH) CVE-2026-55831 | io.netty_netty_codec_http | 4.1.135.Final | 4.2.16.Final, 4.1.136.Final

We have the latest version of metabase but it doesn't have the latest version of netty. Our options are:

  1. Wait until metabase updates with a newer version of netty, but we have to roll out a newer metabase soon since the production instance is still running on v0.50.21.4 which showed 50+ vulnerabilities when I tried to run it in the pipeline. It would be better than keeping as-is on prod.

  2. Surgically replace the old netty in the metabase jar in our Dockerfile with a version that has the fixes, but this could break things, since metabase itself likely hasn't even tested with newer netty. Even if we don't have immediate problems, there could be runtime issues down the road.

  3. Clone the entire metabase repository to our wrapper Dockerfile and edit netty config there, though this could cause a lot of overhead/maintenance.

My manager explicitly said options 2 and 3 are not viable because "We can’t sustain a [company name] version of Metabase diverging from the source and recompile, we don’t have resourcing to do that."

For now I am asking security to give us 7 days exemption in the pipeline so we can deploy, and in the meantime remediate these issues. Does anyone have any ideas besides just waiting?

Thanks for any help.

2

Check Bump netty by galdre · Pull Request #78641 · metabase/metabase · GitHub, we’re releasing new minor versions across all our last 5-6 major versions to patch this

3

BTW: by running v50 you’re in a bigger trouble than a single vulnerable dependency that might not even be exploitable

4

This is perfect. Will give this PR link to our security team. Thank you so much!

5

I’m assuming this doesn’t have a published release yet? What version minimum?

6

not released in 63 still, you might have to wait for 63.3 probably