As observed in WEJBHTTP-19, Xnio requires "("java.net.SocketPermission" "localhost:0" "listen,resolve")" permission even for outbound connection when bind() call could be omitted.

It would be sufficient to not replace null by INET_ANY_ADDRESS in
https://github.com/xnio/xnio/blob/3.6.3.Final/api/src/main/java/org/xnio/XnioIoThread.java#L254 and bind() operation would be skipped and no listen permission would be needed.