apache / apache/servicecomb-java-chassis
[SECURITY] - 依赖软件 org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.40 有安全漏洞 bug
Open
bug
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 814
- Avg merge
- 8d 23h
- Merged PRs (30d)
- 1
Description
### Steps to Reproduce
org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.40 有安全漏洞，
软件依赖路径：
org.apache.servicecomb:java-chassis-spring-boot-starter-servlet -> org.springframework.boot:spring-boot-starter-web:jar:3.4.5 -> org.springframework.boot:spring-boot-starter-tomcat:jar:3.4.5 -> org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.40
参考信息：
https://nvd.nist.gov/vuln/detail/CVE-2025-48989
https://github.com/advisories/GHSA-gqp3-2cvr-x8m3
### Expected Behavior
升级org.springframework.boot:spring-boot-starter-web:jar:3.4.5到3.4.9
### Servicecomb Version
3.3.0
### Additional Context
_No response_
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.