OKAPI-1265: Okapi 6: Vertx 4.5.35, Netty 4.1.139, Jackson 2.21.7 fixing vulns

[julianladisch]

https://folio-org.atlassian.net/browse/OKAPI-1265

For Okapi 6.2.x bump Vert.x from 4.5.34 to 4.5.35.

Vert.x 4.5.35 fixes multiples security vulnerabilities https://vertx.io/blog/eclipse-vert-x-4-5-35/ :

• ChainAuthHandler bypasses scope checks on pre-authenticated users
• CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages
• Compressed WebSocket frames and messages maximum allocation is not enforced
• Heap exhaustion via unbounded RESP array allocation in Vert.x Redis client
• Denial of service via unbounded TDS message reassembly in Vert.x MSSQL client
• Unsafe Java deserialization of UDT column data in Vert.x DB2 client
• Denial of service via unbounded array allocation in Vert.x PostgreSQL client
• Denial of service via uncapped column count allocation in Vert.x MySQL client
• Denial of Service via Spoofed Message Length in Vert.x PostgreSQL Client
• Denial of Service via Unbounded Multi-Packet Reassembly in Vert.x MySQL Client
• Quadratic complexity in JSON Schema uniqueItems validation
• Eclipse Vert.x MQTT client unbounded inbound QoS 2 message retention allows broker-driven denial of service
• gRPC compressed messages are only bounded by their compressed size, allowing compression bomb attacks

Vert.x 4.5.35 bumps Netty from 4.1.138 to 4.1.139 and Jackson 2.21.6 to 2.21.7: vert-x3/vertx-dependencies@4.5.34...4.5.35

Netty 4.1.139 fixes multiple security vulnerabilities https://netty.io/news/2026/10/06/4-1-139-Final.html :

• https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg parser desync in io.netty:netty-codec-haproxy
• https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3 improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6 origin validation error in io.netty:netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38 unbounded resource consumption in io.netty:netty-codec-http2
• https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59 request/response smuggling in io.netty:netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8 time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp SNI routing bypass in io.netty:netty-handler
• https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5 unbounded resource consumption in io.netty:netty-codec-xml
• https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv unbounded resource consumption in io.netty:netty-codec-base
• https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9 unbounded resource consumption in io.netty:netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr input misinterpretation in io.netty:netty-codec-socks
• https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4 improper access control in io.netty:netty-handler
• https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr unbounded resource consumption in io.netty:netty-codec-dns

Jackson 2.21.7 fixes multiples security vulnerabilities https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.7 :

• CVE-2026-89407 Optimize NumberInput.looksLikeValidNumber
• CVE-2026-89425 Honor maxErrorTokenLength in UTF8DataInputJsonParser
• CVE-2026-91776 Prevent unbounded growth of type id cache in TypeDeserializer
• CVE-2026-91777 Avoid quadratic forward-reference resolution in Collection/Map deserializers

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud