From cd312111d6b37f69d3a83aea62de556565c356f8 Mon Sep 17 00:00:00 2001 From: Julian Ladisch Date: Thu, 8 Oct 2026 11:49:47 +0200 Subject: [PATCH] OKAPI-1265: Okapi 6: Vertx 4.5.35, Netty 4.1.139, Jackson 2.21.7 https://folio-org.atlassian.net/browse/OKAPI-1265 For Okapi 6.2.x bump Vert.x from 4.5.34 to 4.5.35. Vert.x 4.5.35 fixes multiples security vulnerabilities https://vertx.io/blog/eclipse-vert-x-4-5-35/ : * [ChainAuthHandler bypasses scope checks on pre-authenticated users](https://github.com/vert-x3/vertx-web/security/advisories/GHSA-2p39-cr56-w58j) * [CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages](https://github.com/vert-x3/vertx-mail-client/security/advisories/GHSA-rm5c-2c7f-gc5g) * [Compressed WebSocket frames and messages maximum allocation is not enforced](https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-h722-h6c2-6j3c) * [Heap exhaustion via unbounded RESP array allocation in Vert.x Redis client](https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-4wf9-p5hg-98w5) * [Denial of service via unbounded TDS message reassembly in Vert.x MSSQL client](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-fg6c-83v6-vhq4) * [Unsafe Java deserialization of UDT column data in Vert.x DB2 client](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-j4vf-w939-pgxf) * [Denial of service via unbounded array allocation in Vert.x PostgreSQL client](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-xqmh-8fhj-48fp) * [Denial of service via uncapped column count allocation in Vert.x MySQL client](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-9jxp-x3fr-ffqh) * [Denial of Service via Spoofed Message Length in Vert.x PostgreSQL Client](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-hm2j-xp3c-jff2) * [Denial of Service via Unbounded Multi-Packet Reassembly in Vert.x MySQL Client](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-75hv-9xj3-3cr8) * [Quadratic complexity in JSON Schema uniqueItems validation](https://github.com/eclipse-vertx/vertx-json-schema/security/advisories/GHSA-4m87-8qfr-8p8m) * [Eclipse Vert.x MQTT client unbounded inbound QoS 2 message retention allows broker-driven denial of service](https://github.com/vert-x3/vertx-mqtt/security/advisories/GHSA-46xj-5735-6qrp) * [gRPC compressed messages are only bounded by their compressed size, allowing compression bomb attacks](https://github.com/eclipse-vertx/vertx-grpc/security/advisories/GHSA-4wvq-75mw-q6cg) Vert.x 4.5.35 bumps Netty from 4.1.138 to 4.1.139 and Jackson 2.21.6 to 2.21.7: https://github.com/vert-x3/vertx-dependencies/compare/4.5.34...4.5.35 Netty 4.1.139 fixes multiple security vulnerabilities https://netty.io/news/2026/10/06/4-1-139-Final.html : * https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg parser desync in io.netty:netty-codec-haproxy * https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3 improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http * https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6 origin validation error in io.netty:netty-codec-http * https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38 unbounded resource consumption in io.netty:netty-codec-http2 * https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59 request/response smuggling in io.netty:netty-codec-http * https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8 time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp * https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp SNI routing bypass in io.netty:netty-handler * https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5 unbounded resource consumption in io.netty:netty-codec-xml * https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv unbounded resource consumption in io.netty:netty-codec-base * https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9 unbounded resource consumption in io.netty:netty-codec-http * https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr input misinterpretation in io.netty:netty-codec-socks * https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4 improper access control in io.netty:netty-handler * https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr unbounded resource consumption in io.netty:netty-codec-dns Jackson 2.21.7 fixes multiples security vulnerabilities https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.7 : * [CVE-2026-89407](https://github.com/advisories/GHSA-p6pp-m3f8-5c89) Optimize NumberInput.looksLikeValidNumber * [CVE-2026-89425](https://github.com/advisories/GHSA-7hhh-6rmp-j9qf) Honor maxErrorTokenLength in UTF8DataInputJsonParser * [CVE-2026-91776](https://github.com/advisories/GHSA-wv8q-qhhj-9h54) Prevent unbounded growth of type id cache in TypeDeserializer * [CVE-2026-91777](https://github.com/advisories/GHSA-cxp5-3px4-pw24) Avoid quadratic forward-reference resolution in Collection/Map deserializers --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index de915bf40..6233d7b2f 100644 --- a/pom.xml +++ b/pom.xml @@ -42,7 +42,7 @@ io.vertx vertx-stack-depchain - 4.5.34 + 4.5.35 pom import