USPR-13775: bump netty resolutionStrategy floor to 4.2.16.Final - #385
Merged
catarina-correia merged 2 commits intoJul 31, 2026
Merged
Conversation
USPR-13775: Fix GHSA-mvh2-crg5-v77c (io.netty:netty-codec-http zlib header block decompression bomb). Bump the enforced netty floor version in root build.gradle from 4.2.15.Final to 4.2.16.Final. Updated the because() advisory comment to include GHSA-mvh2-crg5-v77c while retaining all previously-listed CVE references. Co-Authored-By: Catarina Correia <catarina.correia@getyourguide.com>
Update Spring Dependency Management BOM overrides in both example subprojects (example-spring-boot-starter-web and example-spring-boot-starter-webflux) to use netty 4.2.16.Final, matching the bump to the root resolutionStrategy floor. This ensures examples remain consistent with the enforced netty version and are not vulnerable to GHSA-mvh2-crg5-v77c. Co-Authored-By: Catarina Correia <catarina.correia@getyourguide.com>
catarina-correia
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context & Problem
Dependabot security alert #106 on openapi-validation-java flags io.netty:netty-codec-http versions 4.2.0.Final-4.2.15.Final as vulnerable to a zlib header block decompression bomb issue (GHSA-mvh2-crg5-v77c, high severity), patched in 4.2.16.Final. The repo's root build.gradle pins/enforces netty at exactly 4.2.15.Final via a resolutionStrategy.eachDependency block (added for earlier, unrelated CVEs), which is now itself within the newly disclosed vulnerable range. USPR-13775
Solution
Bumped the enforced io.netty floor in the root build.gradle resolutionStrategy.eachDependency block from 4.2.15.Final to 4.2.16.Final, and extended the existing
because(...)advisory comment to add GHSA-mvh2-crg5-v77c while keeping all previously-listed GHSA references (multiple prior Netty CVEs already fixed by 4.2.15.Final).Note: beyond the literal build.gradle change described in the ticket, I also bumped the two
ext['netty.version'] = '4.2.15.Final'overrides in examples/example-spring-boot-starter-web/build.gradle and examples/example-spring-boot-starter-webflux/build.gradle to 4.2.16.Final. These are Spring Dependency Management BOM overrides that pin netty independently of the root resolutionStrategy; the prior USPR-13707 commit (850a009) updated both the resolutionStrategy and these two example overrides together when the netty floor last moved, so leaving them at 4.2.15.Final here would have left the examples still vulnerable. This follows that established pattern.Verification
🔍 Braintrust trace