This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 498725e1cc4 [NO-ISSUE] Fix CVE-2026-18710 in mongodb-driver-core
(#7093)
498725e1cc4 is described below
commit 498725e1cc43bb2fae8e79d56df262d7451d8a2a
Author: athirakm94 <[email protected]>
AuthorDate: Thu Sep 10 16:20:26 2026 +0530
[NO-ISSUE] Fix CVE-2026-18710 in mongodb-driver-core (#7093)
* fix(cve): pin MongoDB driver artifacts to 5.9.2 (CVE-2026-18710 /
JAVA-6266)
- kie-parent/pom.xml: upgrade version.mongodb-driver-sync 5.5.1 -> 5.9.2
- kogito-quarkus/bom/pom.xml: add explicit dependencyManagement overrides
for
mongodb-driver-sync, mongodb-driver-core, mongodb-driver-reactivestreams,
bson, bson-record-codec before quarkus-bom import so they take precedence
over quarkus-bom:3.27.x which hard-pins all MongoDB artifacts to 5.5.1
- kogito-springboot/bom/pom.xml: add explicit dependencyManagement overrides
for mongodb-driver-core, bson, bson-record-codec before
spring-boot-dependencies
import so they take precedence over spring-boot-dependencies:4.0.x which
imports mongodb-driver-bom:5.6.5
https://jira.mongodb.org/browse/JAVA-6266
* changing CVE fix comment for MongoDB driver
Remove comment regarding MongoDB driver version pinning.
* Remove redundant version.mongodb-driver-sync property from
kogito-spring-boot-bom
The property is already defined in kie-parent/pom.xml at 5.9.2.
The dependencyManagement overrides for mongodb-driver-core, bson, and
bson-record-codec are kept — they are still needed to override the version
pinned by spring-boot-dependencies via mongodb-driver-bom.
---
kie-parent/pom.xml | 2 +-
kogito-quarkus/bom/pom.xml | 29 +++++++++++++++++++++++++++++
kogito-springboot/bom/pom.xml | 20 ++++++++++++++++++--
3 files changed, 48 insertions(+), 3 deletions(-)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index bc30e404300..cc9fece515f 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -197,7 +197,7 @@
<version.maven.plugin>3.15.1</version.maven.plugin>
<version.maven.project>2.2.1</version.maven.project>
<version.maven.resolver.api>1.9.27</version.maven.resolver.api>
- <version.mongodb-driver-sync>5.5.1</version.mongodb-driver-sync>
+ <version.mongodb-driver-sync>5.9.2</version.mongodb-driver-sync>
<version.nashorn>15.3</version.nashorn>
<version.native2ascii-maven-plugin>1.0-beta-1</version.native2ascii-maven-plugin>
<version.net.byte-buddy>1.17.6</version.net.byte-buddy>
diff --git a/kogito-quarkus/bom/pom.xml b/kogito-quarkus/bom/pom.xml
index 77447fd4500..aa0c07f0afc 100644
--- a/kogito-quarkus/bom/pom.xml
+++ b/kogito-quarkus/bom/pom.xml
@@ -149,6 +149,35 @@
<artifactId>quarkus-reactive-messaging-http-deployment</artifactId>
<version>${version.io.quarkiverse.reactivemessaging.http}</version>
</dependency>
+ <!-- CVE fix: quarkus-bom:3.33.x pins all MongoDB driver artifacts to
5.5.1.
+ Override to match
mongodb-driver-sync:${version.mongodb-driver-sync} already
+ pinned in kie-parent. Must appear before the quarkus-bom import to
take precedence.
+ https://jira.mongodb.org/browse/JAVA-6266 -->
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>mongodb-driver-sync</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>mongodb-driver-core</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>mongodb-driver-reactivestreams</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>bson</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>bson-record-codec</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-bom</artifactId>
diff --git a/kogito-springboot/bom/pom.xml b/kogito-springboot/bom/pom.xml
index 50c2d73ecfb..3b75896f422 100644
--- a/kogito-springboot/bom/pom.xml
+++ b/kogito-springboot/bom/pom.xml
@@ -38,8 +38,6 @@
<version.io.fabric8>7.4.0</version.io.fabric8>
<version.io.netty>4.2.17.Final</version.io.netty>
<version.jakarta.servlet>6.0.0</version.jakarta.servlet>
- <!-- This is needed to override the default version inherited from
kie-parent-drools -->
- <version.mongodb-driver-sync>5.6.5</version.mongodb-driver-sync>
<version.org.springdoc>2.8.13</version.org.springdoc>
<version.org.springframework>7.0.9</version.org.springframework>
<version.org.springframework.boot>4.0.8</version.org.springframework.boot>
@@ -87,6 +85,24 @@
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- CVE fix: spring-boot-dependencies:4.0.x imports
mongodb-driver-bom:5.6.5 which pins
+ mongodb-driver-core and bson to 5.6.5. Override to match
mongodb-driver-sync:5.9.2.
+ https://jira.mongodb.org/browse/JAVA-6266 -->
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>mongodb-driver-core</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>bson</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.mongodb</groupId>
+ <artifactId>bson-record-codec</artifactId>
+ <version>${version.mongodb-driver-sync}</version>
+ </dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
