vlsi commented on issue #6714: URL: https://github.com/apache/jmeter/issues/6714#issuecomment-4918611077
Following up on my earlier comment — it turns out the CVEs *are* real for JMeter 5.6.3, they were just hidden from `gradle dependencies` because **`neo4j-java-driver 4.4.13` shades netty** into `org/neo4j/driver/internal/shaded/io/netty/` (about 1700 classes inside the driver JAR). Byte-level scanners (like yours) see it; classpath-level scanners (like the one I originally ran) don't. `neo4j-java-driver 4.4.13` bundles `netty-handler 4.1.104.Final`, which is vulnerable to all the CVEs you listed: - CVE-2025-24970 (fixed in netty-handler 4.1.118) - CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-42583 (all fixed in 4.1.135) Bumped `neo4j-java-driver` to **4.4.26** in [PR #6701](https://github.com/apache/jmeter/pull/6701) (commit `4c69895a5`). 4.4.26 shades `netty-handler 4.1.135.Final`, which carries the fixes for all five CVEs, and stays on Java 8 bytecode (major=52) so the 5.6.x Java 8 hard rule is not broken. Bumping to `neo4j-java-driver` 5.x / 6.x is not an option here — those are compiled for Java 17 (major=61) and would break Java 8. Thanks for the pointer, this would have been missed otherwise. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
