You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "jaedonP (via GitHub)" <gi...@apache.org> on 2026/10/20 15:29:08 UTC
[PR] [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1 [incubator-kie]
jaedonP opened a new pull request, #7217:
URL: https://github.com/apache/incubator-kie/pull/7217
## Summary
Upgrade the OW2 ASM family (`asm`, `asm-analysis`, `asm-commons`, `asm-tree`, `asm-util`) to 9.11.1 across the reactor. Older ASM versions are pulled in transitively and are affected by excessive memory allocation issues in subroutine/JSR successor processing and class parsing (fixed in ASM 9.11):
| Previous version | Where it came from |
|---|---|
| 9.9.1 | quarkus-bom; maven-core (kie-ci, kie-maven-plugin, kogito-maven-plugin and related modules) |
| 9.5 | asm-analysis in the optaplanner-build-parent enforcer plugin |
| 9.3 | json-smart -> accessors-smart (spring-boot-starter-test, json-path, oauth2-oidc-sdk, infinispan-server-resp) |
| 7.3.1 | nashorn-core 15.3 (kie-dmn-core-jsr223, test scope) |
The `dependencyManagement` entries deliberately carry no explicit scope so each transitive path keeps its existing compile/test/provided scope. `kie-quarkus-build-parent` and `kogito-quarkus/bom` need no pin of their own as they inherit the `kie-parent` management. The pins can be removed once json-smart/accessors-smart, maven-core and nashorn-core ship ASM >= 9.11.
## Changes
| File | Change |
|------|--------|
| `kie-parent/pom.xml` | added `version.org.ow2.asm` = 9.11.1 and `dependencyManagement` entries for the ASM family |
| `optaplanner-build/optaplanner-build-parent/pom.xml` | added `version.org.ow2.asm` = 9.11.1, ASM `dependencyManagement` entries ahead of the `quarkus-bom` import (this tree does not inherit `kie-parent`), and enforcer plugin `asm-analysis` 9.5 -> `${version.org.ow2.asm}` |
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1 [incubator-kie]
Posted by "jaedonP (via GitHub)" <gi...@apache.org>.
jaedonP commented on code in PR #7217:
URL: https://github.com/apache/incubator-kie/pull/7217#discussion_r4337686773
##########
kie-parent/pom.xml:
##########
@@ -2064,6 +2066,37 @@
<version>${version.nashorn}</version>
<scope>test</scope>
</dependency>
+ <!-- CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260, CVE-2026-110261, CVE-2026-110263,
+ CVE-2026-110591: ASM family is pulled in transitively at vulnerable versions that kie-parent did not manage:
+ 9.3 via json-smart -> accessors-smart (spring-boot-starter-test, json-path, oauth2-oidc-sdk, infinispan)
+ and 9.9.1 via maven-core (kie-ci, maven plugin modules). Pin all artifacts to 9.11.1 (fix is in >= 9.11).
+ No <scope> on purpose so the scope of each transitive path (test/provided/compile) is preserved.
+ Remove once json-smart/accessors-smart and maven-core ship asm >= 9.11. -->
+ <dependency>
+ <groupId>org.ow2.asm</groupId>
+ <artifactId>asm</artifactId>
+ <version>${version.org.ow2.asm}</version>
+ </dependency>
Review Comment:
@yesamer
The asm-bom import approach turned out not to be viable in this context. Maven's <scope>import</scope> BOM resolution is strictly first-declaration-wins between BOMs, but explicit <dependencyManagement> entries always take precedence over any BOM import regardless of position. Since infinispan-bom, jetty-bom, and other BOMs in kie-parent transitively bring in their own ASM version pins, the asm-bom import was overridden by them even when placed first. The individual explicit entries are the only reliable mechanism to pin these versions across all transitive paths.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1 [incubator-kie]
Posted by "yesamer (via GitHub)" <gi...@apache.org>.
yesamer commented on code in PR #7217:
URL: https://github.com/apache/incubator-kie/pull/7217#discussion_r4335889776
##########
kie-parent/pom.xml:
##########
@@ -286,6 +286,8 @@
<version.org.mvel>2.5.4.Final</version.org.mvel>
<!-- Version of JMH -->
<version.org.openjdk.jmh>1.21</version.org.openjdk.jmh>
+ <!-- override ASM transitive dependency -->
+ <version.org.ow2.asm>9.11.1</version.org.ow2.asm>
Review Comment:
@jaedonP My apologies, you're right, this is actually an override. In that case, it makes sense to add a comment describing which third-party dependencies are pulling in the ASM versions affected by the CVE. My bad, and apologies for the confusion. 😅
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1 [incubator-kie]
Posted by "jaedonP (via GitHub)" <gi...@apache.org>.
jaedonP commented on code in PR #7217:
URL: https://github.com/apache/incubator-kie/pull/7217#discussion_r4335934910
##########
kie-parent/pom.xml:
##########
@@ -286,6 +286,8 @@
<version.org.mvel>2.5.4.Final</version.org.mvel>
<!-- Version of JMH -->
<version.org.openjdk.jmh>1.21</version.org.openjdk.jmh>
+ <!-- override ASM transitive dependency -->
+ <version.org.ow2.asm>9.11.1</version.org.ow2.asm>
Review Comment:
No problem @yesamer I will add the comments back.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1 [incubator-kie]
Posted by "jaedonP (via GitHub)" <gi...@apache.org>.
jaedonP closed pull request #7217: [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1
URL: https://github.com/apache/incubator-kie/pull/7217
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] [NO-ISSUE] upgrade asm from 9.9.1 to 9.11.1 [incubator-kie]
Posted by "yesamer (via GitHub)" <gi...@apache.org>.
yesamer commented on code in PR #7217:
URL: https://github.com/apache/incubator-kie/pull/7217#discussion_r4335224071
##########
kie-parent/pom.xml:
##########
@@ -2064,6 +2066,37 @@
<version>${version.nashorn}</version>
<scope>test</scope>
</dependency>
+ <!-- CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260, CVE-2026-110261, CVE-2026-110263,
+ CVE-2026-110591: ASM family is pulled in transitively at vulnerable versions that kie-parent did not manage:
+ 9.3 via json-smart -> accessors-smart (spring-boot-starter-test, json-path, oauth2-oidc-sdk, infinispan)
+ and 9.9.1 via maven-core (kie-ci, maven plugin modules). Pin all artifacts to 9.11.1 (fix is in >= 9.11).
+ No <scope> on purpose so the scope of each transitive path (test/provided/compile) is preserved.
+ Remove once json-smart/accessors-smart and maven-core ship asm >= 9.11. -->
Review Comment:
@jaedonP In this context comments are not valuable, in general we add a comment in case we are overriding transitive dependencies from a dep.
##########
kie-parent/pom.xml:
##########
@@ -2064,6 +2066,37 @@
<version>${version.nashorn}</version>
<scope>test</scope>
</dependency>
+ <!-- CVE-2026-110257, CVE-2026-110258, CVE-2026-110259, CVE-2026-110260, CVE-2026-110261, CVE-2026-110263,
+ CVE-2026-110591: ASM family is pulled in transitively at vulnerable versions that kie-parent did not manage:
+ 9.3 via json-smart -> accessors-smart (spring-boot-starter-test, json-path, oauth2-oidc-sdk, infinispan)
+ and 9.9.1 via maven-core (kie-ci, maven plugin modules). Pin all artifacts to 9.11.1 (fix is in >= 9.11).
+ No <scope> on purpose so the scope of each transitive path (test/provided/compile) is preserved.
+ Remove once json-smart/accessors-smart and maven-core ship asm >= 9.11. -->
+ <dependency>
+ <groupId>org.ow2.asm</groupId>
+ <artifactId>asm</artifactId>
+ <version>${version.org.ow2.asm}</version>
+ </dependency>
Review Comment:
@jaedonP Can't we use a bom that groups all those dependencies instead?
##########
kie-parent/pom.xml:
##########
@@ -286,6 +286,8 @@
<version.org.mvel>2.5.4.Final</version.org.mvel>
<!-- Version of JMH -->
<version.org.openjdk.jmh>1.21</version.org.openjdk.jmh>
+ <!-- CVE-2026-110257..110263, CVE-2026-110591, CVE-2026-110270: baseline version for OW2 ASM, enforced via dependencyManagement below. -->
Review Comment:
@jaedonP Same
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org