Hi Andor, I looked into the CVE-s reported by the OWASP scan and all of these Prometheus related are false positives - they don't affect the Java library:
- CVE-2026-54285 - it affects only opentelemetry-js: the OpenTelemetry JavaScript Client - CVE-2026-41078 and CVE-2026-40894 - it affects only OpenTelemetry dotnet - CVE-2026-39882 and CVE-2026-41178 - it affects only OpenTelemetry-Go: the Go implementation of OpenTelemetry - CVE-2026-44967 - it affects only OpenTelemetry-cpp: the C++ implementation of OpenTelemetry https://github.com/apache/zookeeper/pull/2453 What do you think? BTW: I agree, it seems to be very hard to keep up unfortunately. Thanks, Dávid Andor Molnár <[email protected]> ezt írta (időpont: 2026. szept. 2., Sze, 18:20): > It’s not just Netty. Some prometheus stuff just got flagged on master and > Jetty 9.x is still flagged on branch-3.9. > > I’m planning to make release on both release lines 3.8.x and 3.9.x and I’m > not sure I can keep up with the pace of these updates. > > Shall we release without requiring a clean Owasp build? Releases will soon > get outdated anyways in that regard. > > Andor > > > > > > On Sep 2, 2026, at 11:06, David Smiley <[email protected]> wrote: > > > > Sigh.... Netty is a CVE generator, more so than any project I can think > > of. All the better to unblock users of ZK that don't need/want Netty. > > ZOOKEEPER-4835 is coming to a ZK version soon, hopefully. > > > > On Wed, Sep 2, 2026 at 11:10 AM Andor Molnár <[email protected]> wrote: > > > >> Merged. > >> > >> Thanks David! > >> > >> > >> > >>> On Sep 2, 2026, at 08:00, Dávid Paksy <[email protected]> wrote: > >>> > >>> HI Andor, > >>> > >>> I created https://issues.apache.org/jira/browse/ZOOKEEPER-5086 and a > >> new PR > >>> for this. > >>> > >>> Best Regards, > >>> Dávid > >>> > >>> Andor Molnár <[email protected]> ezt írta (időpont: 2026. szept. 1., K, > >>> 17:00): > >>> > >>>> Hi team, > >>>> > >>>> Netty 4.1.136 is already flagged with: > >>>> > >>>> 09:31:46 [ERROR] netty-transport-4.1.136.Final.jar > >>>> (pkg:maven/io.netty/[email protected], > >>>> cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*): CVE-2026-62380(6.3) > >>>> > >>>> Could somebody please create a patch to address it? > >>>> > >>>> Andor > >>>> > >>>> > >>>> > >> > >> > >
