Package
opensearch-3-security-analytics
Component
netty-codec-http2
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
This vulnerability exists in netty-codec-http2 4.1.133.Final which is bundled/shaded inside security-analytics-commons-1.0.0.jar. As a pre-built binary artifact, the embedded dependencies cannot be updated independently. This requires a new upstream release of OpenSearch security-analytics with updated bundled dependencies.
The jar is not resolved from a Maven repository: security-analytics commits it to its repository root and consumes it via "api files(sa_commons_file_path)" in build.gradle (tag 3.7.0.0), alongside an in-tree TODO noting SA commons is not yet published to Maven Central. No dependency force, version catalog change, or resolutionStrategy in our build can move the netty embedded in it.
Core opensearch-3 already ships netty 4.2.15.Final and is not detected for this vulnerability; only the vendored commons jar lags at 4.1.133.Final. The fix on the 4.1.x line is 4.1.136.Final.
Status