JinwooHwang opened a new pull request, #8004: URL: https://github.com/apache/geode/pull/8004
## Summary Upgrade `httpcore5` and `httpcore5-h2` from 5.3.4 to 5.3.6 to address a high-severity security vulnerability in `httpcore5-h2`. - `org.apache.httpcomponents.core5:httpcore5`: 5.3.4 → 5.3.6 - `org.apache.httpcomponents.core5:httpcore5-h2`: 5.3.4 → 5.3.6 ## Security Vulnerability | Field | Value | |---|---| | Snyk ID | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052 | | CVE | CVE-2025-8671 | | Type | Denial of Service (DoS) (CWE-400) | | Severity | 8.7 HIGH (CVSS v4.0) | | Affected Package | org.apache.httpcomponents.core5:httpcore5-h2 | | Affected Versions | [0, 5.3.5) | | Fixed Version | 5.3.5 | | Disclosed | 13 Aug 2025 | | Published | 31 Mar 2026 | ### Description Affected versions of this package are vulnerable to Denial of Service (DoS) due to incorrect stream accounting in the handling of server-sent stream resets. An attacker can cause excessive server resource consumption by rapidly opening streams and triggering resets using malformed frames or flow control errors, resulting in the server processing an unbounded number of concurrent streams on a single connection. ### References - [CVE-2025-8671](https://www.cve.org/CVERecord?id=CVE-2025-8671) - [Snyk Vulnerability (SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052)](https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052) - [Fix Commit](https://github.com/apache/httpcomponents-core/commit/12df2bd8115d24e78c24223d16002a8ef78b8ca9) ## Changes | File | Description | |---|---| | DependencyConstraints.groovy | Updated httpcore5 and httpcore5-h2 versions from 5.3.4 to 5.3.6 | | assembly_content.txt | Updated httpcore5 and httpcore5-h2 jar filenames to new versions | | gfsh_dependency_classpath.txt | Updated httpcore5 and httpcore5-h2 jar filenames to new versions | | dependency_classpath.txt | Updated httpcore5 and httpcore5-h2 jar filenames to new versions | ## Testing - `build` — compiles successfully - `test` — unit tests pass <!-- Thank you for submitting a contribution to Apache Geode. --> <!-- In order to streamline review of your contribution we ask that you ensure you've taken the following steps. --> ### For all changes, please confirm: - [x] Is there a JIRA ticket associated with this PR? Is it referenced in the commit message? - [x] Has your PR been rebased against the latest commit within the target branch (typically `develop`)? - [x] Is your initial contribution a single, squashed commit? - [x] Does `gradlew build` run cleanly? - [ ] Have you written or updated unit tests to verify your changes? - [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
