You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by "guptas6est (via GitHub)" <gi...@apache.org> on 2025/11/27 14:05:50 UTC
[PR] Fix: Upgrade Netty 4, Commons-Lang3 and Spring Security to remediate CVEs [dubbo]
guptas6est opened a new pull request, #15809:
URL: https://github.com/apache/dubbo/pull/15809
## What is the purpose of the change?
This PR upgrades Netty 4, Apache Commons-Lang3, gRPC, and Spring Security 6 versions across the Dubbo build to remediate multiple security vulnerabilities detected by Trivy and OWASP Dependency-Check.
The new versions align Dubbo with the minimum fixed versions published in the CVE advisories and ensure the framework is not affected by reported DoS, Path Traversal, Recursion, and HTTP/2 attack vectors.
### Summary of CVEs remediated
**Netty / gRPC related**
- CVE-2025-55163 – Netty HTTP/2 “MadeYouReset” DDoS Vulnerability
- CVE-2025-58057 – Netty BrotliDecoder DoS (zip-bomb style)
- CVE-2025-58056 – Netty HTTP request smuggling
- CVE-2025-59419 – Netty SMTP Command Injection
**Apache Commons-Lang3**
- CVE-2025-48924 – Apache Commons-Lang3 uncontrolled recursion vulnerability
**Spring Security**
- CVE-2025-41248 – Spring Security authorization bypass
## Checklist
- [x] Make sure there is a [GitHub_issue](https://github.com/apache/dubbo/issues) field for the change.
- [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
- [x] Write necessary unit-test to verify your logic correction. If the new feature or significant change is committed, please remember to add sample in [dubbo samples](https://github.com/apache/dubbo-samples) project.
- [x] Make sure gitHub actions can pass. [Why the workflow is failing and how to fix it?](../CONTRIBUTING.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Fix: Upgrade Netty 4, Commons-Lang3 and Spring Security to remediate CVEs [dubbo]
Posted by "zrlw (via GitHub)" <gi...@apache.org>.
zrlw commented on PR #15809:
URL: https://github.com/apache/dubbo/pull/15809#issuecomment-3645527137
commons_lang3_version had been bumped to 3.18.0 and its version should not be defined again at dubbo-test-check module
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Fix: Upgrade Netty 4, Commons-Lang3 and Spring Security to remediate CVEs [dubbo]
Posted by "zrlw (via GitHub)" <gi...@apache.org>.
zrlw closed pull request #15809: Fix: Upgrade Netty 4, Commons-Lang3 and Spring Security to remediate CVEs
URL: https://github.com/apache/dubbo/pull/15809
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Fix: Upgrade Netty 4, Commons-Lang3 and Spring Security to remediate CVEs [dubbo]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #15809:
URL: https://github.com/apache/dubbo/pull/15809#issuecomment-3586189016
## [Codecov](https://app.codecov.io/gh/apache/dubbo/pull/15809?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 32.57%. Comparing base ([`7b48706`](https://app.codecov.io/gh/apache/dubbo/commit/7b48706491665b98dd22284c2c254ea214cd6f30?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`151f7b8`](https://app.codecov.io/gh/apache/dubbo/commit/151f7b835456ddeca8bf23fa5bdc8d970726886a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
> :exclamation: There is a different number of reports uploaded between BASE (7b48706) and HEAD (151f7b8). Click for more details.
>
> <details><summary>HEAD has 7 uploads less than BASE</summary>
>
>| Flag | BASE (7b48706) | HEAD (151f7b8) |
>|------|------|------|
>|samples-tests-java8|1|0|
>|samples-tests-java21|1|0|
>|unit-tests-java25|1|0|
>|unit-tests-java11|1|0|
>|unit-tests-java21|1|0|
>|unit-tests-java8|1|0|
>|unit-tests-java17|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 3.3 #15809 +/- ##
=============================================
- Coverage 60.75% 32.57% -28.18%
+ Complexity 11695 10213 -1482
=============================================
Files 1938 1937 -1
Lines 88679 88657 -22
Branches 13386 13302 -84
=============================================
- Hits 53877 28883 -24994
- Misses 29270 55512 +26242
+ Partials 5532 4262 -1270
```
| [Flag](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [integration-tests-java21](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `32.36% <ø> (-0.01%)` | :arrow_down: |
| [integration-tests-java8](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `32.51% <ø> (+0.07%)` | :arrow_up: |
| [samples-tests-java21](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [samples-tests-java8](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit-tests-java11](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit-tests-java17](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit-tests-java21](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit-tests-java25](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit-tests-java8](https://app.codecov.io/gh/apache/dubbo/pull/15809/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/dubbo/pull/15809?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Fix: Upgrade Netty 4, Commons-Lang3 and Spring Security to remediate CVEs [dubbo]
Posted by "RainYuY (via GitHub)" <gi...@apache.org>.
RainYuY commented on code in PR #15809:
URL: https://github.com/apache/dubbo/pull/15809#discussion_r2571674311
##########
dubbo-test/dubbo-test-check/pom.xml:
##########
@@ -55,6 +55,7 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
+ <version>3.18.0</version>
Review Comment:
use properties
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org