Skip to content

Commit 0a26b29

Browse files
Copilotgygrobot
andauthored
fix: upgrade io.netty:netty-codec-http to 4.2.13.Final (GHSA-57rv-r2g8-2cj3)
Add resolutionStrategy.eachDependency constraint to force io.netty:netty-codec-http to 4.2.13.Final to address HttpClientCodec response desynchronization vulnerability. Related: CHK-13428, GHSA-57rv-r2g8-2cj3, GitHub alert #60 Agent-Logs-Url: https://github.com/getyourguide/openapi-validation-java/sessions/9949f828-0f32-4b78-be7b-ae7303b39bb2 Co-authored-by: gygrobot <19344429+gygrobot@users.noreply.github.com>
1 parent e39dd4e commit 0a26b29

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

build.gradle

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ subprojects {
3535
useVersion('11.0.21')
3636
because('GHSA-rv64-5gf8-9qq8 / GHSA-x4m4-345f-5h5g / GHSA-24j9-x2wg-9qv6: Apache Tomcat < 11.0.21 vulnerabilities')
3737
}
38+
if (requested.group == 'io.netty' && requested.name == 'netty-codec-http'
39+
&& requested.version != null && requested.version < '4.2.13.Final') {
40+
useVersion('4.2.13.Final')
41+
because('GHSA-57rv-r2g8-2cj3: Netty HttpClientCodec response desynchronization vulnerability')
42+
}
3843
}
3944
}
4045

0 commit comments

Comments
 (0)