apache / apache/maven-site-plugin
Jetty deps are vulnerable to CVE-2026-2332, which NIST flags as CRITICAL
- Dominant language
- Java
- Stars
- 55
- Forks
- 50
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 11
Description
### New feature, improvement proposal
First, thank you very much for developing the maven-site-plugin and releasing it to the general public.
https://github.com/apache/maven-site-plugin/blob/55ebd9fb33a76b2f3aaf81dfdf4e8475bb3e4b4b/pom.xml#L200
As per https://nvd.nist.gov/vuln/detail/CVE-2026-2332, the Eclipse Jetty Suite is vulnerable to "request smuggling" and the NIST marks the severity of this vulnerability as critical.
Would it be possible to bump the jetty dependency to >=9.4.60 and release?
Thanks again and cheers,
--
Christopher
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in pom.xml around line 200, where the Jetty dependency is referenced, and compare its version with the NIST CVE-2026-2332 report. Update the dependency to version 9.4.60 or newer, then verify that the project resolves the updated Jetty version and that the change is ready for a release.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100