Skip to content

fix(deps): vuln minor upgrades — 7 packages (minor: 6 · patch: 1) [samples/server] - #49

Closed
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/maven/server/6-1781594209
Closed

fix(deps): vuln minor upgrades — 7 packages (minor: 6 · patch: 1) [samples/server]#49
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/maven/server/6-1781594209

Conversation

@gh-worker-campaigns-3e9aa4

Copy link
Copy Markdown

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • samples/server (maven)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.


Updates

Package From To Type Dep Type Vulnerabilities Fixed
io.undertow:undertow-core 2.3.14.Final 2.4.1.Final minor Direct 2 CRITICAL, 6 HIGH, 2 MEDIUM
io.springfox:springfox-swagger-ui 2.6.0 2.10.5 minor Direct 2 CRITICAL
org.apache.cxf:cxf-rt-rs-service-description 3.3.0 3.6.11 minor Direct 2 HIGH
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
ch.qos.logback:logback-core 1.4.14 1.5.34 minor Direct 2 MEDIUM, 2 LOW
com.jayway.jsonpath:json-path 2.2.0 2.10.0 minor Direct 2 MEDIUM
org.apache.commons:commons-lang3 3.6 3.20.0 minor Direct 2 MEDIUM
io.vertx:vertx-web 3.9.12 3.9.16 patch Direct 2 MEDIUM, 2 LOW
io.vertx:vertx-web 3.9.12 3.9.16 patch Direct 2 MEDIUM, 2 LOW

Security Details

🚨 Critical & High Severity (12 fixed)
Package CVE Severity Summary Unsafe Version Fixed In
io.springfox:springfox-swagger-ui CVE-2019-17495 CRITICAL - 2.6.0 -
io.springfox:springfox-swagger-ui GHSA-c427-hjc3-wrfw CRITICAL Cross-site scripting in Swagger-UI 2.6.0 2.10.0
io.undertow:undertow-core GHSA-j382-5jj3-vw4j CRITICAL Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests 2.3.14.Final 2.3.21.Final
io.undertow:undertow-core CVE-2025-12543 CRITICAL - 2.3.14.Final -
io.undertow:undertow-core GHSA-xpp6-8r3j-ww43 HIGH Undertow Denial of Service vulnerability 2.3.14.Final 2.3.15.Final
io.undertow:undertow-core CVE-2025-9784 HIGH - 2.3.14.Final -
io.undertow:undertow-core GHSA-95h4-w6j8-2rp8 HIGH Undertow MadeYouReset HTTP/2 DDoS Vulnerability 2.3.14.Final 2.2.38.Final
io.undertow:undertow-core GHSA-9623-mqmm-5rcf HIGH Undertow vulnerable to Race Condition 2.3.14.Final 2.2.36.Final
io.undertow:undertow-core GHSA-6h4f-pj3g-q8fq HIGH Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded 2.3.14.Final 2.2.39.Final
io.undertow:undertow-core GHSA-33hj-rcmx-86mv HIGH Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names 2.3.14.Final 2.2.39.Final
org.apache.cxf:cxf-rt-rs-service-description GHSA-5m3j-pxh7-455p HIGH Apache CXF: SSRF vulnerability via WADL stylesheet parameter 3.3.0 4.0.5
org.apache.cxf:cxf-rt-rs-service-description CVE-2024-29736 HIGH - 3.3.0 -
ℹ️ Other Vulnerabilities (46)
Package CVE Severity Summary Unsafe Version Fixed In
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-25qh-j22f-pwp8 MODERATE QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing 1.4.14 1.5.19
ch.qos.logback:logback-core GHSA-pr98-23f8-jwxv MODERATE QOS.CH logback-core Expression Language Injection vulnerability 1.4.14 1.5.13
com.jayway.jsonpath:json-path CVE-2023-51074 MODERATE - 2.2.0 -
com.jayway.jsonpath:json-path GHSA-pfh2-hfmq-phg5 MODERATE json-path Out-of-bounds Write vulnerability 2.2.0 2.9.0
io.undertow:undertow-core GHSA-3x3v-w654-m28m MODERATE Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests 2.3.14.Final 2.4.0.Beta1
io.undertow:undertow-core GHSA-ch7q-gpff-h9hp MODERATE Undertow Missing Release of Memory after Effective Lifetime vulnerability 2.3.14.Final 2.3.15.Final
io.vertx:vertx-web CVE-2025-11965 MODERATE - 3.9.12 -
io.vertx:vertx-web GHSA-h5fg-jpgr-rv9c MODERATE Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories 3.9.12 4.5.22
io.vertx:vertx-web GHSA-h5fg-jpgr-rv9c MODERATE Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories 3.9.12 4.5.22
io.vertx:vertx-web CVE-2025-11965 MODERATE - 3.9.12 -
org.apache.commons:commons-lang3 GHSA-j288-q9x7-2f5v MODERATE Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs 3.6 3.18.0
org.apache.commons:commons-lang3 CVE-2025-48924 MODERATE - 3.6 -
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
ch.qos.logback:logback-core GHSA-qqpg-mvqg-649v LOW Logback allows an attacker to instantiate classes already present on the class path 1.4.14 1.5.25
ch.qos.logback:logback-core GHSA-6v67-2wr5-gvf4 LOW QOS.CH logback-core Server-Side Request Forgery vulnerability 1.4.14 1.5.13
io.vertx:vertx-web GHSA-45p5-v273-3qqr LOW Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names 3.9.12 4.5.22
io.vertx:vertx-web CVE-2025-11966 LOW - 3.9.12 -
io.vertx:vertx-web GHSA-45p5-v273-3qqr LOW Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names 3.9.12 4.5.22
io.vertx:vertx-web CVE-2025-11966 LOW - 3.9.12 -
⚠️ Dependencies that have Reached EOL (4)
Dependency Unsafe Version EOL Date New Version Path
com.jayway.jsonpath:json-path 2.2.0 - 2.10.0 samples/server/petstore/java-undertow/pom.xml
io.springfox:springfox-swagger-ui 2.6.0 - 2.10.5 samples/server/petstore/java-pkmst/pom.xml
org.apache.commons:commons-lang3 3.6 - 3.20.0 samples/server/petstore/java-pkmst/pom.xml
org.apache.cxf:cxf-rt-rs-service-description 3.3.0 - 3.6.11 samples/server/petstore/jaxrs-cxf-test-data/pom.xml

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-prod-us1-3

datadog-prod-us1-3 Bot commented Jun 16, 2026

Copy link
Copy Markdown

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 3 Pipeline jobs failed

OpenAPI Generator | Samples up-to-date   View in Datadog   GitHub Actions

Linux tests | Build: JDK 17 (ubuntu-latest)   View in Datadog   GitHub Actions

Windows tests | Build (17)   View in Datadog   GitHub Actions

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 96179b8 | Docs | Datadog PR Page | Give us feedback!

@gh-worker-campaigns-3e9aa4
gh-worker-campaigns-3e9aa4 Bot deleted the engraver-auto-version-upgrade/minorpatch/maven/server/6-1781594209 branch July 19, 2026 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants