Hi mg, There are tools which report on known vulnerabilities in the Java ecosystem. We monitor Groovy dependencies with those tools.
Past Groovy CVEs are listed on the security page: https://groovy-lang.org/security.html The ASF has a security scanning process using the latest AI frontier models to proactively look for potential vulnerabilities. Groovy has been through 2 rounds and is likely to go through a third round soon. Cheers, Paul. On Wed, Oct 28, 2026 at 2:56 AM MG <[email protected]> wrote: > > Hi .+, > > Regarding to the following vulnerability in the Google Brotli decoder library: > > CVE-2026-111497 (CVSSv4.0 9.2) (also known as Brotli2Shell, Node2Shell, > HTTP2Shell, Broccoli2Shell, and Brotlipocalypse). > > I have only found info on the following affected Java library: > > brotli4j, used by Netty-based stacks (fix: upgrade to 1.24.0, which bundles > Brotli 1.2.1). > > Do we already have info on: > > More vulnerabilitiesin the broader Java eco system ? > Specific Groovy vulnerabilities ? > > Cheers, > mg > >
