From 4d50ac3a927720db6d89315f86ef3d06e6181bfe Mon Sep 17 00:00:00 2001 From: halibobo1205 Date: Thu, 2 Apr 2026 12:58:41 +0800 Subject: [PATCH 1/4] fix CVE-2026-33871 --- build.gradle | 11 + gradle/verification-metadata.xml | 335 ++++++++++++++++--------------- protocol/build.gradle | 2 +- 3 files changed, 189 insertions(+), 159 deletions(-) diff --git a/build.gradle b/build.gradle index 12a0622db99..1ebb3e19bf1 100644 --- a/build.gradle +++ b/build.gradle @@ -144,6 +144,17 @@ subprojects { details.because("Automatically replace android guava with jre version: ${requestedVersion} -> ${jreVersion}") } } + // Fix CVE-2026-33871: Netty HTTP/2 CONTINUATION Frame Flood DoS + // Affected: netty-codec-http2 < 4.1.132.Final + // https://github.com/advisories/GHSA-w9fj-cfpg-grvv + if (details.requested.group == 'io.netty') { + def nettyVersion = details.requested.version + if (nettyVersion != null && nettyVersion.startsWith('4.1.') && + nettyVersion < '4.1.132.Final') { + details.useVersion('4.1.132.Final') + details.because("CVE-2026-33871: force Netty >= 4.1.132.Final to fix HTTP/2 CONTINUATION frame DoS") + } + } } } } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 4d0bf1013d6..7714e81b7c0 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -292,12 +292,12 @@ - - - + + + - - + + @@ -324,12 +324,12 @@ - - - + + + - - + + @@ -340,9 +340,9 @@ - - - + + + @@ -363,12 +363,12 @@ - - - + + + - - + + @@ -381,9 +381,9 @@ - - - + + + @@ -394,12 +394,12 @@ - - - + + + - - + + @@ -444,15 +444,15 @@ - - - + + + - - + + - - + + @@ -485,14 +485,14 @@ - - - + + + - - - + + + @@ -516,12 +516,12 @@ - - - + + + - - + + @@ -865,76 +865,76 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -962,97 +962,97 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -1676,12 +1676,12 @@ - - - + + + - - + + @@ -1689,9 +1689,9 @@ - - - + + + @@ -1699,9 +1699,9 @@ - - - + + + @@ -1989,6 +1989,17 @@ + + + + + + + + + + + @@ -2021,6 +2032,14 @@ + + + + + + + + diff --git a/protocol/build.gradle b/protocol/build.gradle index 789d27b6360..b3c0c9a8269 100644 --- a/protocol/build.gradle +++ b/protocol/build.gradle @@ -1,7 +1,7 @@ apply plugin: 'com.google.protobuf' def protobufVersion = '3.25.8' -def grpcVersion = '1.75.0' +def grpcVersion = '1.80.0' dependencies { api group: 'com.google.protobuf', name: 'protobuf-java', version: protobufVersion From a29254e4d8951dbc309e90f4501916104def3e68 Mon Sep 17 00:00:00 2001 From: halibobo1205 Date: Thu, 2 Apr 2026 16:08:23 +0800 Subject: [PATCH 2/4] fix GHSA-72hv-8253-57qq --- common/build.gradle | 2 +- gradle/verification-metadata.xml | 74 ++++++++++++++++++-------------- 2 files changed, 42 insertions(+), 34 deletions(-) diff --git a/common/build.gradle b/common/build.gradle index 98fc3257190..acde43a1ea9 100644 --- a/common/build.gradle +++ b/common/build.gradle @@ -8,7 +8,7 @@ sourceCompatibility = 1.8 dependencies { - api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.3' // https://github.com/FasterXML/jackson-databind/issues/3627 + api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.6' // https://github.com/FasterXML/jackson-databind/issues/3627 api "com.cedarsoftware:java-util:3.2.0" api group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1' api group: 'commons-codec', name: 'commons-codec', version: '1.11' diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 7714e81b7c0..50cb085b7ba 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -164,9 +164,9 @@ - - - + + + @@ -174,9 +174,9 @@ - - - + + + @@ -184,9 +184,9 @@ - - - + + + @@ -194,9 +194,9 @@ - - - + + + @@ -204,15 +204,15 @@ - - - + + + - - + + - - + + @@ -220,15 +220,15 @@ - - - + + + - - + + - - + + @@ -236,15 +236,15 @@ - - - + + + - - + + - - + + @@ -2024,6 +2024,14 @@ + + + + + + + + From effe1724825b6348d7d6c9a32938d6369f2a3ce7 Mon Sep 17 00:00:00 2001 From: halibobo1205 Date: Thu, 2 Apr 2026 16:23:36 +0800 Subject: [PATCH 3/4] fix CVE-2025-70952 --- framework/build.gradle | 2 +- gradle/verification-metadata.xml | 26 +++++++++++++------------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/framework/build.gradle b/framework/build.gradle index d884b6a7c49..ef2b71a38fd 100644 --- a/framework/build.gradle +++ b/framework/build.gradle @@ -53,7 +53,7 @@ dependencies { // https://mvnrepository.com/artifact/javax.portlet/portlet-api compileOnly group: 'javax.portlet', name: 'portlet-api', version: '3.0.1' - implementation (group: 'org.pf4j', name: 'pf4j', version: '3.10.0') { + implementation (group: 'org.pf4j', name: 'pf4j', version: '3.14.1') { exclude group: "org.slf4j", module: "slf4j-api" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 50cb085b7ba..1cb5ade1d04 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -266,12 +266,12 @@ - - - + + + - - + + @@ -2172,17 +2172,17 @@ - - - + + + - - + + - - - + + + From d1757611b84f384d3261323b98147f154c59936a Mon Sep 17 00:00:00 2001 From: halibobo1205 Date: Thu, 2 Apr 2026 16:33:44 +0800 Subject: [PATCH 4/4] fix CVE-2025-5115 --- framework/build.gradle | 4 +- gradle/verification-metadata.xml | 76 ++++++++++++++++---------------- 2 files changed, 40 insertions(+), 40 deletions(-) diff --git a/framework/build.gradle b/framework/build.gradle index ef2b71a38fd..1aa266da3cd 100644 --- a/framework/build.gradle +++ b/framework/build.gradle @@ -42,8 +42,8 @@ dependencies { implementation group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2' implementation group: 'com.github.davidb', name: 'metrics-influxdb', version: '0.8.2' // http - implementation 'org.eclipse.jetty:jetty-server:9.4.57.v20241219' - implementation 'org.eclipse.jetty:jetty-servlet:9.4.57.v20241219' + implementation 'org.eclipse.jetty:jetty-server:9.4.58.v20250814' + implementation 'org.eclipse.jetty:jetty-servlet:9.4.58.v20250814' implementation 'com.alibaba:fastjson:1.2.83' // end http diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 1cb5ade1d04..8b89745c1a9 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -1728,65 +1728,65 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + +