This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 00a8f955dea [NO-ISSUE]: upgrade log4j-api to 2.26.1 in to address
cve (#6869)
00a8f955dea is described below
commit 00a8f955dea528170c716207054e6822a68a273b
Author: athirakm94 <[email protected]>
AuthorDate: Fri Aug 7 11:31:05 2026 +0530
[NO-ISSUE]: upgrade log4j-api to 2.26.1 in to address cve (#6869)
* fix(cve): upgrade log4j-api to 2.26.1 to address CVE-2026-49844
CVE-2026-49844 affects org.apache.logging.log4j:log4j-api versions
below 2.25.5. Two vulnerable version paths were identified:
1. Spring Boot path (log4j-api:2.25.4)
spring-boot-dependencies:4.0.7 sets log4j2.version=2.25.4 and
hardcodes log4j-api/log4j-to-slf4j/log4j-jul at that version in
its dependencyManagement. Fix applied in kogito-spring-boot-bom:
- Add <log4j2.version>2.26.1</log4j2.version> property override
- Add explicit log4j-api, log4j-to-slf4j, log4j-jul managed entries
BEFORE the spring-boot-dependencies import (Maven first-declaration-
wins rule overrides the hardcoded 2.25.4 in the imported BOM)
2. OptaPlanner/Quarkus path (log4j-api:2.25.1)
quarkus-bom:3.27.4.1 manages log4j-api:2.25.1 which is promoted into
the resolved classpath via optaplanner-examples' direct dependency on
log4j-to-slf4j. Fix applied in optaplanner-build-parent:
- Upgrade version.org.apache.logging.log4j from 2.22.1 to 2.26.1
- Add explicit log4j-api managed entry to override quarkus-bom's 2.25.1
Affected modules (before -> after):
drools-rules-spring-boot-starter: log4j-api:2.25.4 -> 2.26.1
kogito-spring-boot-starter: log4j-api:2.25.4 -> 2.26.1
data-index-common-springboot: log4j-api:2.25.4 -> 2.26.1
data-index-graphql-addons-springboot: log4j-api:2.25.4 -> 2.26.1
optaplanner-examples: log4j-api:2.25.1 -> 2.26.1
No changes required in incubator-kie-kogito-examples or
incubator-kie-tools (fix propagates from this upstream BOM).
Quarkus modules are not affected (log4j-api never resolves to
classpath; Quarkus uses JBoss LogManager).
Ref: https://logging.apache.org/security.html#CVE-2026-49844
* fix(cve): pin log4j-api to 2.26.1 in kie-parent to address CVE-2026-49844
Two additional vulnerable transitive paths were identified in the
full dependency tree (test.txt):
1. poi-ooxml path (log4j-api:2.24.3)
poi-ooxml:5.4.1 imports log4j-bom:2.24.3 and declares log4j-api
as a direct compile dependency with no explicit version — resolved
to 2.24.3 from its own BOM. Affects:
- drools-decisiontables, kie-maven-plugin, kogito-maven-plugin
- Drools examples, DMN validation, xls2dmn, Impact Analysis
- Kogito Gradle Plugin, and all modules using drools-decisiontables
2. quarkus-bom path (log4j-api:2.25.1)
quarkus-bom:3.27.4.1 manages log4j-api:2.25.1 directly. This
wins over poi's 2.24.3 in quarkus modules. Affects:
- drools-quarkus-integration-test (and variants)
- jBPM/Drools/Kogito Quarkus extension integration tests
Fix: add version.org.apache.logging.log4j=2.26.1 property and an
explicit log4j-api managed entry in kie-parent/pom.xml dependencyManagement.
kie-parent is the common root for all drools, dmn, pmml, maven-plugin,
and quarkus modules; a single entry here overrides both the poi-ooxml
and quarkus-bom transitive versions.
Before / after (all modules):
log4j-api:2.24.3 (poi-ooxml path) -> 2.26.1
log4j-api:2.25.1 (quarkus-bom path) -> 2.26.1
Previously fixed (commit 637b75de3e5):
log4j-api:2.25.4 (spring-boot path) -> 2.26.1 [kogito-spring-boot-bom]
log4j-api:2.25.1 (optaplanner path) -> 2.26.1 [optaplanner-build-parent]
Ref: https://logging.apache.org/security.html#CVE-2026-49844
* CI Retrigger
---
kie-parent/pom.xml | 13 +++++++++++++
kogito-springboot/bom/pom.xml | 4 ++++
optaplanner-build/optaplanner-build-parent/pom.xml | 10 +++++++++-
3 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index c97d64b44c1..0c063540941 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -223,6 +223,11 @@
<version.org.apache.groovy>4.0.29</version.org.apache.groovy>
<version.org.apache.httpcomponents.httpcore>4.4.16</version.org.apache.httpcomponents.httpcore>
<version.org.apache.kafka>4.1.2</version.org.apache.kafka>
+ <!-- CVE-2026-49844: poi-ooxml:5.4.1 pulls log4j-api:2.24.3 transitively
via log4j-bom:2.24.3.
+ quarkus-bom:3.27.4.1 promotes it to 2.25.1. Both are below the
minimum safe version 2.25.5.
+ This managed entry forces 2.26.1 across all modules inheriting
kie-parent.
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
<version.org.apache.maven>3.9.11</version.org.apache.maven>
<version.org.apache.maven.resolver>1.7.3</version.org.apache.maven.resolver>
<version.org.apache.maven.wagon>3.5.3</version.org.apache.maven.wagon>
@@ -1337,6 +1342,14 @@
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <!-- CVE-2026-49844: override log4j-api version pulled in transitively
by poi-ooxml:5.4.1
+ (via log4j-bom:2.24.3) and promoted by quarkus-bom:3.27.4.1 (to
2.25.1).
+ Both are vulnerable; this pins the version to 2.26.1 for all
inheriting modules. -->
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-api</artifactId>
+ <version>${version.org.apache.logging.log4j}</version>
+ </dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-artifact</artifactId>
diff --git a/kogito-springboot/bom/pom.xml b/kogito-springboot/bom/pom.xml
index 3b913a1158b..7fa2315e1d8 100644
--- a/kogito-springboot/bom/pom.xml
+++ b/kogito-springboot/bom/pom.xml
@@ -48,6 +48,10 @@
2025.1.1 specifically targets Spring Boot 4.0.1+. -->
<!--
https://github.com/spring-cloud/spring-cloud-release/wiki/Spring-Cloud-2025.1-Release-Notes
-->
<version.org.springframework.cloud>2025.1.1</version.org.springframework.cloud>
+ <!-- CVE-2026-49844: Spring Boot 4.0.7 sets log4j2.version=2.25.4 which is
vulnerable.
+ Override the version property inherited from kie-parent to 2.26.1
(minimum 2.25.5).
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
</properties>
<dependencyManagement>
<dependencies>
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index 758d0d5ae39..58c329cd6dc 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -43,7 +43,10 @@
<!-- Normal dependency versions -->
<version.ch.qos.logback>1.5.35</version.ch.qos.logback>
- <version.org.apache.logging.log4j>2.22.1</version.org.apache.logging.log4j>
+ <!-- CVE-2026-49844: log4j-api versions below 2.25.5 are vulnerable.
Upgrade log4j to 2.26.1.
+ This covers log4j-to-slf4j (explicitly managed) and log4j-api
(promoted by quarkus-bom to 2.25.1).
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
<version.com.thoughtworks.xstream>1.4.21</version.com.thoughtworks.xstream>
<version.io.quarkiverse.operatorsdk>6.6.7</version.io.quarkiverse.operatorsdk>
<version.io.quarkus>3.27.4.1</version.io.quarkus>
@@ -164,6 +167,11 @@
<artifactId>logback-classic</artifactId>
<version>${version.ch.qos.logback}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-api</artifactId>
+ <version>${version.org.apache.logging.log4j}</version>
+ </dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-to-slf4j</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
