Forwarder Release Notes

Updated Zulu version related to CVE-2026-114820.

Dependency update related to CVE-2026-102554.

Fix for the eMudhra Intermediate CA vulnerability.

JAR load event deduplication accuracy: The Forwarder could mistake a full JAR load event for the lightweight JAR probe event introduced by JAR load event deduplication (2.0.4), and incorrectly treat it as a duplicate of a JAR Intelligence Cloud had not yet seen in full. This could prevent Intelligence Cloud from receiving the JAR details it had requested. The Forwarder now identifies probe events by their protocol marker instead of inferring it from the event’s contents, so it no longer confuses the two.

JAR detail request delivery: If Intelligence Cloud’s response ended immediately after the JAR detail request section, with no trailing newline, the Forwarder could fail to parse the response and drop it. The affected agent would wait and then resend its event batch about 20 seconds later. The Forwarder now parses this response correctly.

Updated the bundled zlib library to address CVE-2026-85091, a heap buffer overflow that could occur during certain non-blocking compression operations.

TLS-intercepting proxies: If the Forwarder does not trust the certificate chain that a TLS-intercepting proxy presents, it now logs a diagnostic hint. The hint shows the presented issuer and root CA, and suggests two remedies: exempt *.api.ic.azul.com from TLS inspection, or import the proxy’s root CA into the JDK truststore. Previously, the connection failed with a PKIX path building failed error without further guidance.

Connection stability: If a TLS-intercepting proxy injects extra HTTP/2 SETTINGS frames after the initial handshake, the Forwarder now discards the unexpected frames with a warning and keeps the connection open. Previously, the extra frames caused an error that dropped the shared connection to Intelligence Cloud for all in-flight requests.

JAR load event deduplication: Deduplication of JAR load events is now enabled by default. Previously, every JVM that loaded a shared JAR generated a full round trip to Intelligence Cloud, even when other JVMs had already reported the same JAR. The Forwarder now identifies JARs by a hash of their central directory and forwards only unique JAR load events. The Forwarder suppresses duplicate JAR load requests and the resulting artifact uploads. Deduplication reuses the caches that azul.deduplication.pipeline configures, so you do not need a separate cache.

JAR deduplication options: Use azul.deduplication.jar.enabled to turn JAR load event deduplication on or off, and azul.deduplication.jar.filterMinimal to control the suppression of lightweight JAR probe events. For all options and their environment variables, see All Configuration Options.

Immediate agent response for suppressed requests: When the Forwarder suppresses a duplicate JAR load request, it immediately sends the agent a response that no details are needed. The agent can then release the resources it holds without waiting for Intelligence Cloud.

Fully compatible with all existing Intelligence Cloud Agent versions

No agent-side configuration changes required

Two-layer caching: Fast in-memory cache for low-latency filtering, with an optional disk-based cache that preserves deduplication state across forwarder restarts.

Self-managing: The in-memory cache automatically manages memory under pressure. The disk-based cache auto-recovers from disk errors without manual intervention.

Deduplication monitoring: The health endpoint (/forwarder/health), status page, and Prometheus metrics now include deduplication statistics: saved bytes, dedup ratio, and cache health state.

Flexible deployment: Run with both caches (recommended), in-memory only (for stateless containers without disk), or as a passthrough proxy with deduplication disabled.

Prometheus metrics now include deduplication counters and ratios.

Health endpoint includes deduplication state in the overall health assessment.

Status page displays deduplication effectiveness (saved traffic, ratio).

Fully compatible with all existing Intelligence Cloud Agent versions

No agent-side configuration changes required

Upgrading from 1.x: update the Forwarder JAR and increase memory/disk allocation per the updated requirements above

Internal bugfixes and improvements.

All Forwarder options and properties have been renamed to avoid collisions in configuration property names with other commonly used properties. See Setting Up the Forwarder for more details. Existing configuration files can still be used as the changes are backwards compatible.

The Forwarder now exposes multiple metrics in the Prometheus format, to integrate its statistics in, e.g. a Grafana dashboard, See Forwarder Metrics for more details.

Added support for HTTP/HTTPS proxies, see Forwarder Configuration Options.

All dependencies of the Forwarder are up-to-date and free of vulnerabilities as of the release date.

Issue related to releasing runtime channels during artifact uploads to Intelligence Cloud. Previously, this led to the channel being closed unexpectedly, even if it was in use by another process at the time. This fix ensures that the connection/channel remains available for sharing and reuse as intended.

All dependencies of the Forwarder are up-to-date and free of vulnerabilities as of the release date.

A custom header x-forwarder-time is added into every proxied request directed to Intelligence Cloud, serving as an indication of the time when the Forwarder proxies VM requests to Intelligence Cloud.

Network communication management between the Forwarder and the VM is improved. Robust network problem handling and comprehensive exchange of detailed information from the Forwarder to the VM has been implemented.

The communication state logged on the VM side now contains this information:

 
[CRS.connection][warning] Request postEventBatch failed on attempt 1 of 3,
elapsed (4,361 ms): code= 502, message=Bad Gateway, payload=null, error=[Forwarder]
The channel for uploading the artifact to Azul Intelligence Cloud has become inactive

This contains more detailed information, compared to the log message in earlier versions of the Forwarder:

 
[CRS.connection][warning] Request postEventBatch failed on attempt 1 of 3,
elapsed (4,361 ms): java.net.SocketException: Unexpected end of file from server

The maximum length of the response content that Intelligence Cloud can send to the VM is increased from 64KB to 512KB. Additionally, you can configure the maximum size of response data that the Forwarder may forward to the Runtimes, thus minimizing potential impact.

See for more details Forwarder Configuring Options.

An issue is fixed where the system lacked the capability to effectively manage certificate-related issues arising from the expiration of the Forwarder certificate. In some cases, such as PC hibernation, the scheduled task of re-issuing the certificate was not executed, resulting in the VM rejecting the SSL handshake, despite the Forwarder functioning properly.

Fixed a performance issue with the connection pool used to connect to the cloud:

The issue occurred when two or more threads attempted to establish a connection to the cloud simultaneously, with distinct index values. One thread was required to wait for the other, even though it was unnecessary, resulting in a delay. This unnecessary wait has been eliminated.

Resolved the problem resulting in a truncated response on the client side, which was caused by an incorrect value in the "Content-length" header when proxied by the Forwarder.

All dependencies of the Forwarder are up-to-date and free of vulnerabilities as of the release date.

Resolved an inconsistent state between the Forwarder state and the detailed metrics utilized for the computation of the state.

Enhanced the Forwarder’s functionality by adding comprehensive explanations in case the Forwarder state is not Green, enabling users to identify and address any issues with greater accuracy.

See Status API for an example.

Resolved an issue concerning the retain/release of HTTP messages that were proxied by the Forwarder, which had the potential to result in memory leaks.

Implemented the feature to periodically monitor and store the status of the Forwarder to a file.

See Forwarder Configuring Options for more information.

Fixed issue with duplicate proxied requests.

Fixed IOException: Premature close → channelClosed on Forwarder.

Improved error handling and permissions.

Minimize the number of Forwarder dependencies.

Added the ability to define the log level when starting the Forwarder using three different ways: via properties file, system variable or environment variable.

Fixed format of the Forwarder’s uptime. Added the ability to request extended statistics that include memory and CPU consumption.

Added homepage to the Forwarder when opening the root endpoint.

Simplification of the Forwarder authorization process.

Private key regeneration of the certificate on the Forwarder side during the daily certificate renewal process.

Added the ability to trust certificates issued to Azul by Amazon’s CA when the Forwarder connects to Azul Intelligence Cloud.

No need to manually manage the certificates issued to the Forwarder.