[aikido-autofix]

Upgrade Spring and Netty dependencies to fix open redirect/SSRF vulnerabilities in URL parsing and HTTP/1-to-HTTP/2 conversion host validation bypass attacks.

⚠️ Breaking changes analysis not available for: io.projectreactor.netty:reactor-netty-http, io.projectreactor:reactor-core, io.projectreactor.netty:reactor-netty-core

✅ No breaking changes for: org.springframework:spring-core, org.springframework:spring-webmvc, org.springframework:spring-web, org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-context, io.netty:netty-codec-http2, io.netty:netty-codec-http, io.netty:netty-codec-socks

✅ 19 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2024-22262	HIGH	[spring-core] UriComponentsBuilder fails to properly parse externally provided URLs, allowing attackers to bypass host validation checks and conduct open redirect or SSRF attacks.
CVE-2024-22243	HIGH	[spring-core] UriComponentsBuilder fails to properly validate URLs parsed from external input, allowing attackers to bypass host validation checks and potentially perform open redirect or SSRF attacks.
CVE-2024-22259	HIGH	[spring-core] UriComponentsBuilder fails to properly parse externally provided URLs, allowing attackers to bypass host validation checks and conduct open redirect or SSRF attacks.
CVE-2024-38809	LOW	[spring-core] ETag parsing from "If-Match" or "If-None-Match" request headers is vulnerable to denial of service attacks through unbounded header processing.
AIKIDO-2026-592216	HIGH	[netty-codec-http2] HTTP/1-to-HTTP/2 conversion incorrectly prioritizes the Host header over request-target authority, allowing attackers to bypass host validation and routing controls through mismatched authority values. This enables host/tenant boundary bypass, cache poisoning, and unintended upstream routing.
AIKIDO-2026-918525	HIGH	[netty-codec-http2] HTTP/1-to-HTTP/2 conversion improperly handles CONNECT requests, using the Host header instead of the request-target for the :authority pseudo-header, enabling request smuggling and tunnel-destination bypass in proxies.
AIKIDO-2026-58442	HIGH	[netty-codec-http2] HTTP/2 Extended CONNECT requests are improperly downgraded to plain CONNECT tunnels, dropping protocol and path metadata that downstream handlers use for routing and authorization, allowing security policies to be bypassed.
AIKIDO-2026-739270	MEDIUM	[netty-codec-http2] HTTP/2 decompression leaks direct ByteBuf memory when DATA frames are sent on closed decompressor channels, allowing remote attackers to exhaust memory and cause DoS via repeated requests on long-lived connections.
AIKIDO-2026-453463	LOW	[netty-codec-http2] HTTP/2 header values lack validation by default, allowing prohibited octets (NUL, CR, LF) to pass through, enabling request smuggling and response splitting when translated to HTTP/1.1 by proxies or gateways.
AIKIDO-2026-275094	LOW	[netty-codec-http2] Remote clients can send HTTP/2 SETTINGS frames with extremely large header-table sizes, causing the encoder to retain headers indefinitely and degrade to O(n²) lookups, resulting in denial of service through throughput collapse.
AIKIDO-2026-664762	HIGH	[netty-codec-http] Multiple HTTP codec vulnerabilities enable denial-of-service attacks through unbounded queues and memory exhaustion, plus request smuggling via improper chunk-extension and Transfer-Encoding validation. Fixes add bounds checking and stricter validation.
AIKIDO-2026-179204	HIGH	[netty-codec-http] HTTP request/response pairing logic incorrectly matches 1xx interim responses to pipelined requests, causing response bodies to be misrouted and enabling HTTP response splitting and smuggling attacks.
AIKIDO-2026-240696	HIGH	[netty-codec-socks] SOCKS4/5 encoders fail to reject null bytes and CRLF in domain, userid, and credential fields, enabling hostname spoofing, authentication bypass, and connection redirection to unintended targets.
AIKIDO-2026-980617	MEDIUM	[reactor-netty-http] A WebSocket handshake redirect to a different origin can leak credentials when the HTTP client is configured to follow redirects, allowing a remote attacker to intercept credentials meant for the original host.
AIKIDO-2026-718872	MEDIUM	[reactor-netty-http] A vulnerability allows incorrect evaluation of remote IP addresses when HAProxy Protocol is enabled, potentially leading to access-control bypass or incorrect logging based on wrong client identity. This impacts security decisions that rely on the client's IP address.
AIKIDO-2026-556582	LOW	[reactor-netty-http] A remote attacker can cause excessive memory consumption by sending HTTP/1.1 pipelined requests on a single connection, leading to denial of service and reduced server availability. The vulnerability allows degradation or exhaustion of server resources through memory exhaustion.
AIKIDO-2026-268979	MEDIUM	[reactor-core] A 20-bit index wrap in Flux.windowTimeout with fair backpressure can cause the operator to hang indefinitely on long-lived streams, allowing attackers to exhaust resources through denial of service.
AIKIDO-2026-224455	MEDIUM	[reactor-core] A race condition in Flux.bufferTimeout with fair backpressure can cause the stream to hang when upstream items arrive during buffer flushing, leaving items unprocessed. An attacker can exploit this to exhaust subscriptions, resulting in denial of service.
AIKIDO-2026-592409	LOW	[reactor-netty-core] A DNS resolver configuration can be incorrectly reused across multiple dynamically created clients with different resolver settings, causing traffic to be routed to unintended destinations. This allows an attacker to perform DNS hijacking or traffic redirection attacks.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-21311
• https://aikido.atlassian.net/browse/AIK-21290

🤖 Remediation details

Fix security vulnerabilities in Spring Framework and Netty/Reactor transitive dependencies

Short summary

This PR updates two direct compileOnly dependencies in agent/build.gradle to remediate vulnerabilities in the following packages: org.springframework:spring-web, org.springframework:spring-core, org.springframework:spring-beans, io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-socks, io.projectreactor.netty:reactor-netty-http, io.projectreactor.netty:reactor-netty-core, and io.projectreactor:reactor-core. All fixes are applied exclusively in agent/build.gradle; no lockfile exists for this module.

org.springframework:spring-web

Declared directly as compileOnly 'org.springframework:spring-web:5.3.20' in agent/build.gradle, bumped to 5.3.38. Version 5.3.20 is vulnerable to multiple URL-parsing and redirect vulnerabilities (patched at 5.3.32, 5.3.33, 5.3.34, and 5.3.38 respectively); 5.3.38 is the smallest 5.x release that satisfies all four patch floors. The bump also moves the transitively resolved spring-beans and spring-core from 5.3.20 to 5.3.38.

org.springframework:spring-core

Resolved transitively through the direct org.springframework:spring-web dependency. Fixed by bumping spring-web to 5.3.38, which carries spring-core (and spring-jcl) at the same version, clearing all Spring Framework CVEs.

org.springframework:spring-beans

Resolved transitively through org.springframework:spring-web → spring-beans. Fixed by the same spring-web bump to 5.3.38; spring-beans moves in lockstep with the rest of the Spring Framework artifact set.

io.projectreactor.netty:reactor-netty-http

Declared directly as compileOnly 'io.projectreactor.netty:reactor-netty-http:1.2.18' in agent/build.gradle, bumped to 1.3.7. Version 1.2.18 is itself vulnerable (patched at 1.3.7) and also introduces vulnerable versions of Netty and Reactor transitive artifacts; 1.3.7 is the smallest release that satisfies the 1.3.7 patch floor and simultaneously pulls in all downstream Netty and Reactor artifacts at their required patched versions.

io.projectreactor.netty:reactor-netty-core

Resolved transitively via reactor-netty-http → reactor-netty-core. Fixed by bumping reactor-netty-http to 1.3.7, which carries reactor-netty-core:1.3.7, satisfying the ≥ 1.3.7 patch requirement.

io.projectreactor:reactor-core

Resolved transitively via reactor-netty-http → reactor-netty-core → reactor-core. Fixed by bumping reactor-netty-http to 1.3.7, which resolves reactor-core at 3.8.7, satisfying the ≥ 3.8.7 patch requirement.

io.netty:netty-codec-http

Resolved transitively via reactor-netty-http → netty-codec-http. Fixed by bumping reactor-netty-http to 1.3.7, which resolves netty-codec-http at 4.2.17.Final, satisfying the ≥ 4.1.138.Final / ≥ 4.2.18.Final patch floor (4.2.17.Final meets the 4.1.x series floor of 4.1.137.Final for the socks advisory and 4.1.138.Final for the http advisory via the 4.2.x line).

io.netty:netty-codec-http2

Resolved transitively via reactor-netty-http → netty-codec-http2. Fixed by bumping reactor-netty-http to 1.3.7, which resolves netty-codec-http2 at 4.2.17.Final, satisfying the ≥ 4.1.138.Final patch floor across all six Netty HTTP/2 advisories.

io.netty:netty-codec-socks

Resolved transitively via reactor-netty-http → reactor-netty-core → netty-handler-proxy → netty-codec-socks. Fixed by bumping reactor-netty-http to 1.3.7, which resolves netty-codec-socks at 4.2.17.Final, satisfying the ≥ 4.1.137.Final patch requirement.

Version changes

Package	From	To	Why updated
io.projectreactor.netty:reactor-netty-http	1.2.18	1.3.7	Direct CVE fix (agent/build.gradle)
org.springframework:spring-web	5.3.20	5.3.38	Direct CVE fix (agent/build.gradle)
org.springframework:spring-beans	5.3.20	5.3.38	Transitive after spring-web bump
org.springframework:spring-core	5.3.20	5.3.38	Transitive after spring-web bump
org.springframework:spring-jcl	5.3.20	5.3.38	Transitive after spring-web bump
io.projectreactor.netty:reactor-netty-core	1.2.18	1.3.7	Transitive after reactor-netty-http bump
io.projectreactor:reactor-core	3.7.x	3.8.7	Transitive after reactor-netty-http bump
io.netty:netty-codec-http	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-codec-http2	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-codec-socks	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-codec-http3	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-handler-proxy	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-handler	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-transport	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-buffer	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-common	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-codec	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-resolver	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump
io.netty:netty-resolver-dns	4.1.135.Final	4.2.17.Final	Transitive after reactor-netty-http bump

[aikido-pr-checks]

2 Open source vulnerabilities detected - high severity
Aikido detected 2 vulnerabilities across 2 packages, it includes 2 high vulnerabilities.

Details

Remediation:

• netty-codec-classes-quic — 1 CVE (high) — fixed in 4.2.18.Final
• netty-codec-http3 — 1 CVE (high) — fixed in 4.2.18.Final

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[aikido-autofix]

Closed by Aikido: the vulnerabilities are already resolved.