CWE-770: Allocation of Resources Without Limits or Throttling through org.apache.httpcomponents.client5:httpclient5@5.6.1

[maurogonzalez]

Describe the feature

CWE-770: Allocation of Resources Without Limits or Throttling

Snyk: CVSS v4.0 7.1 - High Severity

CVSS v3.1 6.5 - Medium Severity

software.amazon.awssdk:aws-sdk-java@2.46.21 › software.amazon.awssdk:sns-message-manager@2.46.21 › org.apache.httpcomponents.client5:httpclient5@5.6.1 › org.apache.httpcomponents.core5:httpcore5-h2@5.4

Use Case

Security team requires us to fix vulnerabilities.

Proposed Solution

Update:

aws-sdk-java-v2/pom.xml

Line 192 in 06f64a4

<httpcomponents.client5.version>5.6.1</httpcomponents.client5.version>

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Java SDK version used

2.46.21,2.47.0

JDK version used

21

Operating System and version

Amazon Linux 2023 (AL2023)

[bhoradc]

Hi @maurogonzalez - Thank you for reporting this. The version bump for httpclient5 would be available in the upcoming SDK release.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

[maurogonzalez]

Hi @bhoradc the SonarQube check failed and looks that release was blocked: