diff --git a/CHANGES.md b/CHANGES.md
index 2984b9541a..a490aa4104 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -27,6 +27,9 @@ Release Notes.
   message to add its headers, and now adds them to the copy of the message that the client sends.
 * Test the `rocketMQ-5.x` plugin with rocketmq-client 5.5, and the `rocketMQ-client-java-5.x` plugin with
   rocketmq-client-java 5.0, 5.1 and 5.2.
+* Bump the netty shaded into the agent from `4.1.124.Final` to `4.1.139.Final` (with netty-tcnative-boringssl-static
+  `2.0.70.Final` → `2.0.84.Final`, the version netty `4.1.139.Final` is built with) to clear the netty-codec,
+  netty-codec-http, netty-codec-http2, netty-handler and netty-handler-proxy CVEs.
 
 All issues and pull requests are [here](https://github.com/apache/skywalking/milestone/267?closed=1)
 
diff --git a/dist-material/LICENSE b/dist-material/LICENSE
index a7cb7efaeb..11f8dd653e 100755
--- a/dist-material/LICENSE
+++ b/dist-material/LICENSE
@@ -221,7 +221,7 @@ The text of each license is the standard Apache 2.0 license.
     Google: proto-google-common-protos 2.59.2: https://github.com/googleapis/googleapis , Apache 2.0
     Google: jsr305 3.0.2: http://central.maven.org/maven2/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.pom , Apache 2.0
     Google: guava 32.1.3: https://github.com/google/guava , Apache 2.0
-    netty 4.1.124: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
+    netty 4.1.139: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
     async-profiler 3.0: https://github.com/async-profiler/async-profiler/blob/v3.0/LICENSE, Apache 2.0
 
 ========================================================================
diff --git a/pom.xml b/pom.xml
index ec35bdd8c5..242d3ed8e2 100755
--- a/pom.xml
+++ b/pom.xml
@@ -91,7 +91,7 @@
         <!-- core lib dependency -->
         <bytebuddy.version>1.17.6</bytebuddy.version>
         <grpc.version>1.74.0</grpc.version>
-        <netty.version>4.1.124.Final</netty.version>
+        <netty.version>4.1.139.Final</netty.version>
         <gson.version>2.13.1</gson.version>
         <!-- Google ends the JAVA8 support since v33 -->
         <!-- Can't upgrade Guava until JAVA8 EOL -->
@@ -101,7 +101,7 @@
         <protobuf-maven-plugin.version>0.6.1</protobuf-maven-plugin.version>
         <com.google.protobuf.protoc.version>3.25.5</com.google.protobuf.protoc.version>
         <protoc-gen-grpc-java.plugin.version>1.74.0</protoc-gen-grpc-java.plugin.version>
-        <netty-tcnative-boringssl-static.version>2.0.70.Final</netty-tcnative-boringssl-static.version>
+        <netty-tcnative-boringssl-static.version>2.0.84.Final</netty-tcnative-boringssl-static.version>
         <javax.annotation-api.version>1.3.2</javax.annotation-api.version>
         <objenesis.version>3.1</objenesis.version>
         <async-profiler.version>3.0</async-profiler.version>