Hi Paul,
1. thnx for the general info.
2. My question was actually aimed at further vulnerabilities
specifically tied to the Brotli lib...
Cheers,
mg
Am 27.10.2026 um 19:15 schrieb Paul King:
Hi mg,
There are tools which report on known vulnerabilities in the Java
ecosystem. We monitor Groovy dependencies with those tools.
Past Groovy CVEs are listed on the security page:
https://groovy-lang.org/security.html
The ASF has a security scanning process using the latest AI frontier
models to proactively look for potential vulnerabilities. Groovy has
been through 2 rounds and is likely to go through a third round soon.
Cheers, Paul.
On Wed, Oct 28, 2026 at 2:56 AM MG<[email protected]> wrote:
Hi .+,
Regarding to the following vulnerability in the Google Brotli decoder library:
CVE-2026-111497 (CVSSv4.0 9.2) (also known as Brotli2Shell, Node2Shell,
HTTP2Shell, Broccoli2Shell, and Brotlipocalypse).
I have only found info on the following affected Java library:
brotli4j, used by Netty-based stacks (fix: upgrade to 1.24.0, which bundles
Brotli 1.2.1).
Do we already have info on:
More vulnerabilitiesin the broader Java eco system ?
Specific Groovy vulnerabilities ?
Cheers,
mg
