Security Update: Address high/critical CVEs in dependencies #6714

Activity

1. vlsi commented on Jun 25, 2026

   

   vlsi

   on Jun 25, 2026

   Collaborator

   More actions

   Thanks for the report. A quick check on the release/5.6.x branch (and on the rel/v5.6.3 baseline) shows that JMeter does not ship any netty jar:

   $ grep -i netty src/dist/src/dist/expected_release_jars.csv
   (no matches)
   $ ./gradlew :src:protocol:bolt:dependencies --configuration runtimeClasspath | grep netty
   (no matches)
   

   The bolt protocol module uses neo4j-java-driver:4.4.13, which still ships the legacy non-netty transport. Netty only entered JMeter's dependency tree on master, where neo4j-java-driver was bumped to 6.x — and master carries netty 4.2.7.Final, not the 4.1.118 / 4.1.135 / 4.1.133 versions mentioned in the report.

   Could you confirm:

   • which artifact you scanned (a stock apache-jmeter-5.6.3.tgz or an installation extended with third-party plugins),
   • which plugins are deployed in lib/ext/?

   If netty shows up via a plugin (jmeter-plugins, Pulsar, Kafka, gRPC, MQTT, etc.), the fix needs to come from that plugin's vendor; JMeter core has no leverage over the netty version pulled by an external plugin.
2. alextitov1 commented on Jun 28, 2026

   

   alextitov1

   on Jun 28, 2026

   Author

   More actions

   We downloaded JMeter from this link https://dlcdn.apache.org//jmeter/binaries/;

   tar -xzf /tmp/jmeter-5.6.3.tgz -C /opt/jmeter

   Here is the report from the vulnerability scanner for one of the CVEs

   The library io.netty:netty-handler version 4.1.104.Final was detected in Maven library manager located at /opt/jmeter/lib/neo4j-java-driver-4.4.13.jar -> META-INF/maven/io.netty/netty-handler and is vulnerable to CVE-2025-24970, which exists in versions >= 4.1.91.Final, <= 4.1.117.Final
   
3. vlsi commented on Jul 7, 2026

   

   vlsi

   on Jul 7, 2026

   Collaborator

   More actions

   Git it. Netty is shaded within neo4j-java-driver-4.4.13.jar
4. cschanhniem commented on Jul 8, 2026

   

   cschanhniem

   on Jul 8, 2026 · Hidden as off-topic

   show commentMore actions
5. vlsi

   added a commit that references this issue on Jul 8, 2026

   fix(deps): bump org.neo4j.driver:neo4j-java-driver to 4.4.26

   ...

   4c69895
6. vlsi commented on Jul 8, 2026

   

   vlsi

   on Jul 8, 2026

   Collaborator

   More actions

   Following up on my earlier comment — it turns out the CVEs are real for JMeter 5.6.3, they were just hidden from gradle dependencies because neo4j-java-driver 4.4.13 shades netty into org/neo4j/driver/internal/shaded/io/netty/ (about 1700 classes inside the driver JAR). Byte-level scanners (like yours) see it; classpath-level scanners (like the one I originally ran) don't.

   neo4j-java-driver 4.4.13 bundles netty-handler 4.1.104.Final, which is vulnerable to all the CVEs you listed:

   • CVE-2025-24970 (fixed in netty-handler 4.1.118)
   • CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-42583 (all fixed in 4.1.135)

   Bumped neo4j-java-driver to 4.4.26 in PR #6701 (commit 4c69895a5). 4.4.26 shades netty-handler 4.1.135.Final, which carries the fixes for all five CVEs, and stays on Java 8 bytecode (major=52) so the 5.6.x Java 8 hard rule is not broken. Bumping to neo4j-java-driver 5.x / 6.x is not an option here — those are compiled for Java 17 (major=61) and would break Java 8.

   Thanks for the pointer, this would have been missed otherwise.
7. vlsi

   added 2 commits that reference this issue on Jul 9, 2026

   fix(deps): bump org.neo4j.driver:neo4j-java-driver to 4.4.26

   ...

   675e312

   fix(deps): bump org.neo4j.driver:neo4j-java-driver to 4.4.26

   ...

   a7bbaff