diff --git a/tez.yaml b/tez.yaml
index 150e31ccd59..0f470afcfd4 100644
--- a/tez.yaml
+++ b/tez.yaml
@@ -1,7 +1,7 @@
 package:
   name: tez
   version: "0.10.5"
-  epoch: 7 # GHSA-m494-w24q-6f7w
+  epoch: 8 # GHSA-84h7-rjj3-6jx4
   description: Apache Tez
   copyright:
     - license: Apache-2.0
diff --git a/tez/pombump-deps.yaml b/tez/pombump-deps.yaml
index 6371f926b3c..98179fbe1fe 100644
--- a/tez/pombump-deps.yaml
+++ b/tez/pombump-deps.yaml
@@ -20,3 +20,6 @@ patches:
   - groupId: com.microsoft.sqlserver
     artifactId: mssql-jdbc
     version: 10.2.4.jre8
+  - groupId: io.netty
+    artifactId: netty-codec-http
+    version: 4.1.129.Final
diff --git a/tez/pombump-properties.yaml b/tez/pombump-properties.yaml
index 431708d0856..cabd83a0ab3 100644
--- a/tez/pombump-properties.yaml
+++ b/tez/pombump-properties.yaml
@@ -1,5 +1,5 @@
 properties:
   - property: netty.version
-    value: 4.1.125.Final
+    value: 4.1.129.Final
   - property: asynchttpclient.version
     value: 2.12.4