Repository navigation
docker-java-transport-zerodep 3.7.1 bundles vulnerable HttpCore5 version 5.3.6 #2651
Description
docker-java-transport-zerodep version 3.7.1 is currently the latest available release. The artifact still embeds Maven metadata referencing HttpCore5 5.3.6 and HttpCore5-h2:5.3.6, and no newer transport artifact is available with an updated HttpCore5 version.
Although httpcore5 and [httpcore5](httpcore5-h2:5.3.6) was excluded from the project's POM, exclusions only affect Maven dependency resolution and do not modify the contents of the published docker-java-transport-zerodep-3.7.1.jar. As a result, OWASP Dependency Check continues to detect the embedded metadata referencing HttpCore5 5.3.6 and HttpCore5-h2:5.3.6 and reports CVE-2026-54399 and CVE-2026-54428.
This is a metadata-based detection and is a known limitation of dependency scanners when analyzing embedded Maven metadata within packaged JARs.
Activity
kush2439p commentedon Jul 27, 2026
Hi, I’d be interested in working on this issue.
I noticed that the zerodep module shades and relocates Apache HttpClient/HttpCore classes into the published JAR, so I’m not sure this can be treated as metadata-only without inspecting the embedded classes.
Would you prefer upgrading HttpClient to a version that uses a patched HttpCore release, or explicitly pinning
httpcore5andhttpcore5-h2to fixed versions?I can prepare a PR once the preferred approach is confirmed. I would also verify the dependency tree, shaded JAR contents, and the existing HTTP/1.1 and HTTP/2 tests.
idoz-jfrog commentedon Aug 6, 2026
similar problem with org.apache.httpcomponents.client5 5.5.1 instead of 5.6.3 - and this is not a "metadata detection problem" since the classes are physically copied into the docker-java-transport-zerodep under shaded directory
mayank-jha-dxc commentedon Aug 7, 2026
@kush2439p / @idoz-jfrog ,
Thanks for looking into this.
The goal is to ensure that docker-java-transport-zerodep no longer ships vulnerable Apache HttpComponents artifacts (or metadata referencing them), so that downstream consumers and dependency scanners no longer report CVE-2026-54399 and CVE-2026-54428.
If upgrading HttpClient results in the shaded JAR using patched httpcore5 and httpcore5-h2 versions while maintaining compatibility, that would be the preferred solution. Otherwise, explicitly pinning httpcore5 and httpcore5-h2 to the patched versions also sounds reasonable.
Verifying the dependency tree, shaded JAR contents, and HTTP/1.1/HTTP/2 tests before submitting the PR would be appreciated.
kush2439p commentedon Aug 8, 2026
PR #2666 appears to address this by upgrading httpclient5 from 5.5.1 to 5.6.3. I’ll verify that the resulting zerodep shaded JAR contains patched HttpCore classes and metadata, and that the HTTP/1.1 and HTTP/2 tests still pass. If everything checks out, I won’t create a duplicate PR.
idoz-jfrog commentedon Aug 15, 2026
@kush2439p @mayank0503-cariad note that PR 2666 was closed - so this remains quite relevant now. I think it was replaced by 2669 - which is fine - but it is not merged yet.