Devdha opened a new pull request, #903: URL: https://github.com/apache/httpcomponents-client/pull/903
## Background CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, fixed in Brotli 1.2.1. HttpClient 5 decompresses `Content-Encoding: br` responses through the optional brotli4j integration (`BrotliDecompressingEntity` / `InflatingBrotliDataConsumer`). The current brotli4j 1.23.0 bundles Brotli 1.2.0, so a malicious or compromised origin can reach the vulnerable decoder. brotli4j 1.24.0 upgrades the bundled native decoder to Brotli 1.2.1: - https://github.com/hyperxpro/Brotli4j/releases/tag/v1.24.0 - https://github.com/hyperxpro/Brotli4j/security/advisories/GHSA-x524-jrqf-vwq6 - https://patchtheplanet.org/brotli ## Change - Bump the `brotli4j.version` property from 1.23.0 to 1.24.0. No API or behavior changes. ## Testing ``` ./mvnw -pl httpclient5 -am -Dtest="*Brotli*" -DfailIfNoTests=false test ``` Results: - `DeflatingBrotliEntityProducerTest`: 1 passed - `InflatingBrotliDataConsumerTest`: 4 passed - `Brotli4jRuntimeTest`: 1 passed Total: 6 tests, 0 failures, 0 errors. I could not find an existing HTTPCLIENT JIRA for this dependency bump; happy to file one if required before review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
