You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "Sergey Nuyanzin (Jira)" <ji...@apache.org> on 2026/06/20 09:23:00 UTC
[jira] [Commented] (FLINK-39670) Bump Flink-controlled Java dependencies to resolve CVEs Part 2 (kafka-clients, okhttp, wiremock)
[ https://issues.apache.org/jira/browse/FLINK-39670?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18090353#comment-18090353 ]
Sergey Nuyanzin commented on FLINK-39670:
-----------------------------------------
Merged as [fd5060787f8964f18e1e262e5a039e510a063fad|https://github.com/apache/flink/commit/fd5060787f8964f18e1e262e5a039e510a063fad]
> Bump Flink-controlled Java dependencies to resolve CVEs Part 2 (kafka-clients, okhttp, wiremock)
> ------------------------------------------------------------------------------------------------
>
> Key: FLINK-39670
> URL: https://issues.apache.org/jira/browse/FLINK-39670
> Project: Flink
> Issue Type: Improvement
> Affects Versions: 2.4.0
> Reporter: Purushottam Sinha
> Assignee: Purushottam Sinha
> Priority: Major
> Labels: pull-request-available, security
>
> Several Flink-controlled Java dependencies have known CVEs requiring updates:
> - kafka-clients 3.2.3 (direct test-scope dep in flink-sql-client-test) contains CVE-2024-31141, CVE-2025-27817
> - okhttp 3.7.0 (hardcoded test-scope override in flink-runtime) contains CVE-2018-20200
> - wiremock-jre8 2.32.0 (test-scope in flink-metrics-influxdb) contains CVE-2023-41327, CVE-2023-41329
>
> *Proposed updates:*
> - Bump kafka-clients to 3.9.2 in flink-sql-client-test (direct test-scope dep)
> - Drop the hardcoded okhttp 3.7.0 in flink-runtime so it inherits ${okhttp.version} (3.14.9) from the root pom
> - Bump wiremock-jre8 to 2.35.2 in flink-metrics-influxdb
>
> *Out of scope:*
> CVEs that come in via Hadoop / Alluxio / kubernetes-client transitives.
> Predecessor: https://issues.apache.org/jira/browse/FLINK-39580
--
This message was sent by Atlassian Jira
(v8.20.10#820010)