From 56dd17b88eb6ccd349985a0a2c85b665adcc47ed Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 20 Aug 2026 05:09:16 +0000 Subject: [PATCH] fix(deps): bump io.netty to 4.2.17.Final to resolve GHSA-8c42-7qj2-3j46 Bump io.netty group dependency version constraint from 4.2.16.Final to 4.2.17.Final in the resolutionStrategy to resolve the CORS Vary header overwrite vulnerability (GHSA-8c42-7qj2-3j46) in io.netty:netty-codec-http, fixed in 4.2.17.Final. Also update the accompanying clause to document this new CVE alongside existing Netty vulnerability references. Updates both the root build.gradle resolutionStrategy and the example subproject netty version overrides. Co-Authored-By: Ronald van Duren --- build.gradle | 8 ++++---- examples/example-spring-boot-starter-web/build.gradle | 2 +- examples/example-spring-boot-starter-webflux/build.gradle | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/build.gradle b/build.gradle index 92713b4..59533e2 100644 --- a/build.gradle +++ b/build.gradle @@ -49,14 +49,14 @@ subprojects { because('GHSA-rv64-5gf8-9qq8 / GHSA-x4m4-345f-5h5g / GHSA-24j9-x2wg-9qv6 / GHSA-gx5v-xp9w-j4cg: Apache Tomcat < 11.0.22 vulnerabilities') } if (requested.group == 'io.netty' - && requested.version != null && requested.version < '4.2.16.Final') { - useVersion('4.2.16.Final') + && requested.version != null && requested.version < '4.2.17.Final') { + useVersion('4.2.17.Final') because('GHSA-38f8-5428-x5cv: HTTP Request Smuggling in io.netty:netty-codec-http via malformed Transfer-Encoding headers; ' + 'GHSA-3qp7-7mw8-wx86 / GHSA-c2rx-5r8w-8xr2 / GHSA-cmm3-54f8-px4j / GHSA-x4gw-5cx5-pgmh / GHSA-676x-f7gg-47vc / ' + 'GHSA-5pvg-856g-cp85 / GHSA-4grm-h2qv-h6w6 / GHSA-c653-97m9-rcg9 / GHSA-563q-j3cm-6jxm / GHSA-hvcg-qmg6-jm4c / ' + 'GHSA-cq4q-cv5g-r8q5 / GHSA-c2gf-v879-257j / GHSA-5x3r-wrvg-rp6q / GHSA-xmv7-r254-6q78 / GHSA-w573-9ffj-6ff9 / ' + - 'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' + - 'after maxHeaderSize truncation, fixed in 4.2.16.Final') + 'GHSA-mvh2-crg5-v77c / GHSA-8c42-7qj2-3j46: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' + + 'after maxHeaderSize truncation, and cache poisoning and information disclosure via CORS Vary header overwrite in io.netty:netty-codec-http, fixed in 4.2.17.Final') } if (requested.group == 'org.springframework' && requested.name == 'spring-core' && requested.version != null && requested.version < '7.0.8') { diff --git a/examples/example-spring-boot-starter-web/build.gradle b/examples/example-spring-boot-starter-web/build.gradle index 89eff0b..9611808 100644 --- a/examples/example-spring-boot-starter-web/build.gradle +++ b/examples/example-spring-boot-starter-web/build.gradle @@ -8,7 +8,7 @@ plugins { ext['jackson-bom.version'] = '3.1.4' ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' -ext['netty.version'] = '4.2.16.Final' +ext['netty.version'] = '4.2.17.Final' ext['tomcat.version'] = '11.0.22' ext['spring-framework.version'] = '7.0.8' diff --git a/examples/example-spring-boot-starter-webflux/build.gradle b/examples/example-spring-boot-starter-webflux/build.gradle index 32c62b5..b6f22db 100644 --- a/examples/example-spring-boot-starter-webflux/build.gradle +++ b/examples/example-spring-boot-starter-webflux/build.gradle @@ -8,7 +8,7 @@ plugins { ext['jackson-bom.version'] = '3.1.4' ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' -ext['netty.version'] = '4.2.16.Final' +ext['netty.version'] = '4.2.17.Final' ext['tomcat.version'] = '11.0.22' ext['spring-framework.version'] = '7.0.8'