According to a few comments in Netty's issue tracker, CVE-2023-4586 is a false positive:

• [Netty 5] Enable hostname verification by default  netty/netty#8537 (comment)
• Security Vulnerability - Common Weakness Enumeration (CWE) CWE-295 netty/netty#9930 (comment)

And it was withdrawn:

• Does CVE-2023-4586 affect io.netty:netty-handler:4.1.100.Final? netty/netty#13665 (comment)

Which tool reported that to you, @BrHowell? I assume it needs to be configured to ignore that CVE.

But merging #2245 would be good, though.

Yes I ended up discovering that withdrawal, and so we're now ignoring the CVE as we're covered by 4.1.100.Final and up.

I forgot about coming back to this issue to update, sorry. I'll close it.

@BrHowell please note that 4.1.100.Final does not "cover" the CVE. The relevant netty API has remained unchanged. It is simply a false positive CVE.