kico-itexto opened a new issue, #16789:
URL: https://github.com/apache/grails-core/issues/16789
### Expected Behavior
Scanning Grails for CVEs I've found some:
Critical on tomcat-embed-core 11.0.24 (fixed on 11.0.25)
CVE-2026-65905 │ DIGEST authenticator: someone who captures a login can
replay it to get in
CVE-2026-65637 │ HTTP/2 requests with no authority can bypass strict SNI
checking
CVE-2026-65182 │ Improper access control / incorrect authorization
│
CVE-2026-68525 │ FORM authentication: incorrect authorization
│
High on jackson-core / jackson-databind - 3.1.6, fixed on 3.1.7
CVE-2026-89425 - jackson-core: invalid-token error messages have no length
limit, so memory can grow without bound (DoS)
CVE-2026-89407 - jackson-core: slow regex check on float numbers (ReDoS)
CVE-2026-91777 - jackson-databind: resolving forward references takes
quadratic time (DoS) CVE-2026-91776 -
jackson-databind: keeps every unknown raw type ID in memory (DoS)
It can be fixed updating the build.gradle file of the project as shown below:
```
dependencies {
constraints {
implementation("org.apache.tomcat.embed:tomcat-embed-core:11.0.25")
implementation("org.apache.tomcat.embed:tomcat-embed-websocket:11.0.25")
implementation("org.apache.tomcat.embed:tomcat-embed-el:11.0.25")
implementation("tools.jackson.core:jackson-core:3.1.7")
implementation("tools.jackson.core:jackson-databind:3.1.7")
}
}
```
Hope it helps! I whould like to start helping the project applying these
fixes. If someone could help me it whould be great!
### Actual Behaviour
Just the vulnerabilities described above
### Steps To Reproduce
_No response_
### Environment Information
_No response_
### Example Application
You can test it on a new empty Grails application
### Version
8.0.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
