java-client icon indicating copy to clipboard operation
java-client copied to clipboard

Please update internal Apache HTTP client5 version because of CVE-2025-27820

Open peterschulerrabo opened this issue 8 months ago • 0 comments

The current version used by Apache HTTP client5 contains a severe vulnerability. See https://nvd.nist.gov/vuln/detail/CVE-2025-27820. As the current release of java-client includes this version it should be upgrade to at least 5.4.3.

Can this be done so the vulnerability is fixed. This also helps with our internal CLM software as this will flag our software which includes java-client as vulnerable and blocks our releases. And as the java-client comes with an internal version of Apache HTTP client5 we can overwrite this version ourself.

A colleague of mine already created a pull request: https://github.com/splitio/java-client/pull/556

peterschulerrabo avatar Apr 30 '25 09:04 peterschulerrabo