[Crawler] Bump httpclient5 to 5.5.1 to resolve CVE-2025-8671 (httpcore5-h2 HTTP/2 DoS)#442
Open
Jan-Kazlouski-elastic wants to merge 1 commit into
Open
[Crawler] Bump httpclient5 to 5.5.1 to resolve CVE-2025-8671 (httpcore5-h2 HTTP/2 DoS)#442Jan-Kazlouski-elastic wants to merge 1 commit into
Jan-Kazlouski-elastic wants to merge 1 commit into
Conversation
Bumps org.apache.httpcomponents.client5:httpclient5 from 5.1 to 5.5.1, which pulls in httpcore5/httpcore5-h2 5.3.6 (>= 5.3.5) and resolves the HTTP/2 stream-reset Denial of Service vulnerability CVE-2025-8671 in httpcore5-h2 < 5.3.5. The newer DnsResolver interface adds a default resolve(String, int) overload returning List<InetSocketAddress>, which httpclient5 5.3+ now invokes from the connection manager. FilteringDnsResolver and the http_client_spec DNS stub are updated to implement both overloads while preserving the existing private-address filtering. Co-authored-by: Cursor <cursoragent@cursor.com>
Member
|
Looks good! Have you had a chance to test crawler out against a random website with this change? |
Author
Yes, a live crawl of |
artem-shelkovnikov
approved these changes
Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of https://github.com/elastic/search-team/issues/13738
Bumps org.apache.httpcomponents.client5:httpclient5 from 5.1 to 5.5.1, which pulls in httpcore5/httpcore5-h2 5.3.6 (>= 5.3.5) and resolves the HTTP/2 stream-reset Denial of Service vulnerability CVE-2025-8671 in httpcore5-h2 < 5.3.5.
The newer DnsResolver interface adds a default resolve(String, int) overload returning List, which httpclient5 5.3+ now invokes from the connection manager. FilteringDnsResolver and the http_client_spec DNS stub are updated to implement both overloads while preserving the existing private-address filtering.
Jars.lockandvendor/jars/were regenerated with the pinned toolchain viamake clean install(not hand-edited).commons-codecis updated 1.15 → 1.17.1 as a transitive result; allBase64usage in the codebase is Ruby stdlib, not the Java library.Checklists
Pre-Review Checklist
crawler.yml.exampleandelasticsearch.yml.example)v0.1.0)make noticeif any dependencies have been added (N/A — version bump only; vendored jars are not tracked inNOTICE.txt)Changes Requiring Extra Attention
Related Pull Requests
Release Note
Upgrade Apache HttpClient (httpclient5 5.5.1 / httpcore5 5.3.6) to remediate CVE-2025-8671, an HTTP/2 stream-reset Denial of Service vulnerability in httpcore5-h2.