diff --git a/pom.xml b/pom.xml
index 3cc3c7a109..d7ad3463c5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,10 +37,9 @@
         <liquibase.version>4.33.0</liquibase.version>
         <liquibase-slf4j.version>5.1.0</liquibase-slf4j.version>
         <cloudfoundry-client.version>5.16.0.RELEASE</cloudfoundry-client.version>
-        <!--reactor netty 1.3.x uses direct memory leading to OOM errors-->
-        <reactor-netty.version>1.2.18</reactor-netty.version>
-        <!-- Override Netty version to fix CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
-        <netty.version>4.1.135.Final</netty.version>
+        <reactor-netty.version>1.3.6</reactor-netty.version>
+        <!-- Override Netty version; aligns with reactor-netty ${reactor-netty.version} and fixes CVE-2026-42583 (Lz4FrameDecoder resource exhaustion) -->
+        <netty.version>4.2.15.Final</netty.version>
         <swagger.version>1.6.16</swagger.version>
         <jclouds.version>2.7.0</jclouds.version>
         <guava.version>33.5.0-jre</guava.version>
@@ -870,6 +869,16 @@
                 <artifactId>reactor-netty</artifactId>
                 <version>${reactor-netty.version}</version>
             </dependency>
+            <dependency>
+                <groupId>io.projectreactor.netty</groupId>
+                <artifactId>reactor-netty-core</artifactId>
+                <version>${reactor-netty.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.projectreactor.netty</groupId>
+                <artifactId>reactor-netty-http</artifactId>
+                <version>${reactor-netty.version}</version>
+            </dependency>
             <!-- https://mvnrepository.com/artifact/org.cloudfoundry.multiapps/multiapps-common -->
             <dependency>
                 <groupId>org.cloudfoundry.multiapps</groupId>