[
https://issues.apache.org/jira/browse/WW-5717?focusedWorklogId=1040827&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1040827
]
ASF GitHub Bot logged work on WW-5717:
--------------------------------------
Author: ASF GitHub Bot
Created on: 11/Sep/26 05:28
Start Date: 11/Sep/26 05:28
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1911:
URL: https://github.com/apache/struts/pull/1911
Fixes [WW-5717](https://issues.apache.org/jira/browse/WW-5717)
The OWASP workflow (`-Pdependency-check -Pjakartaee11`, fail on CVSS ≥ 7)
flags `spring-core-7.0.8.jar` with 17 CVEs from Spring's 2026-08-20 advisory
wave, 12 of them ≥ 7.0. `7.0.9` is the first OSS release covering all of them,
so this bumps the `jakartaee11` profile's `spring.version` from `7.0.8` to
`7.0.9`.
None of the 17 sits on a code path Struts executes — they are Spring MVC /
WebFlux / RSocket, SpEL, `DataBinder`, `UrlHandlerFilter` and
`ContentDisposition` issues, and Struts ships no
`spring-webmvc`/`spring-webflux` at all. Dependency hygiene, not a Struts fix;
the per-CVE breakdown is on the ticket.
**Not changed:** the default profile's `6.2.19`. It is the last OSS 6.2.x
(`6.2.20` is Enterprise-Support-only), CI scans the `jakartaee11` profile, and
suppressing four 9.8s for an EOL line would only hide the real question — that
is [WW-5721](https://issues.apache.org/jira/browse/WW-5721), targeted at 8.0.0.
### Verification
- `mvn test -DskipAssembly -Pjakartaee11 -pl
plugins/spring,plugins/rest,plugins/junit,plugins/testng` — 224 tests, 0
failures
- `mvn org.owasp:dependency-check-maven:aggregate -Pdependency-check
-Pjakartaee11` against an NVD cache refreshed today — 169 dependencies scanned,
all nine Spring jars at 7.0.9, no 2026 Spring CVE reported, `BUILD SUCCESS`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1040827)
Remaining Estimate: 0h
Time Spent: 10m
> Address OWASP dependency-check finding in Spring Framework (spring-core)
> ------------------------------------------------------------------------
>
> Key: WW-5717
> URL: https://issues.apache.org/jira/browse/WW-5717
> Project: Struts 2
> Issue Type: Task
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is
> configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of
> severity) flags a vulnerability in Spring Framework's {{spring-core}}.
> This is a dependency-hygiene item, independent of any current feature branch
> — no source change introduced it; it stems from the pinned Spring version.
> h3. Current Spring versions
> * _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}}
> (jakartaee11 profile)
> * _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
> Both lines should be checked against the reported CVE, since they track
> different Spring release lines.
> h3. Resolution options
> # _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x
> on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding
> clears.
> # _Suppress_ the finding in the OWASP suppression file
> ({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts
> uses Spring (a common situation for dependency-check + Spring). The file
> already curates such false positives; no Spring CVE is suppressed there today.
> h3. Notes
> * {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only
> pulls {{spring-test}} (test scope).
> * The exact CVE id from the scan output should be recorded here to drive the
> decision (upgrade vs. suppress) and to document the rationale if suppressed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
