Sync Collecting Fix Commits: Thu Sep 3 16:01:45 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,41 @@
 {
   "vcs_url": "https://github.com/github/advisory-database",
   "vulnerabilities": {
+    "GHSA-PX8P-9VWX-VF98": {
+      "a050f34f05e2f8cc80cadd159cca6d90e85ea0a0": "Publish Advisories\n\nGHSA-px8p-9vwx-vf98\nGHSA-gw25-m53r-qh88\nGHSA-px8p-9vwx-vf98",
+      "1721417c5dc7c1cbf858e5ea5a5245ea62e70cce": "Publish Advisories\n\nGHSA-4m7v-hj47-rqcr\nGHSA-4r37-9m26-2c4m\nGHSA-7hfj-8497-9m6v\nGHSA-cjff-5v28-x7h8\nGHSA-fcfg-fr25-xwpr\nGHSA-m254-gmq9-65xp\nGHSA-px8p-9vwx-vf98\nGHSA-qjw4-6j2q-9mgr\nGHSA-v36m-hw3w-whpw\nGHSA-wpwx-q57v-jhwg"
+    },
+    "GHSA-GW25-M53R-QH88": {
+      "a050f34f05e2f8cc80cadd159cca6d90e85ea0a0": "Publish Advisories\n\nGHSA-px8p-9vwx-vf98\nGHSA-gw25-m53r-qh88\nGHSA-px8p-9vwx-vf98"
+    },
+    "GHSA-99RQ-75J6-5J9F": {
+      "b2cc3fdc10ab11878c2ba55600601d4a3400a0cf": "Publish GHSA-99rq-75j6-5j9f"
+    },
+    "GHSA-78X9-FHHX-V2G6": {
+      "862d70c079790b752e36adcb8cb50f436a33bf03": "Publish GHSA-78x9-fhhx-v2g6"
+    },
+    "GHSA-6F9W-9HF2-5RG3": {
+      "bed50215e4d9eb845ff0a589a1c50e4b3c73b72b": "Publish GHSA-6f9w-9hf2-5rg3"
+    },
+    "GHSA-XVCM-6775-5M9R": {
+      "48095e5743ad80e79993cd53fb6b15d12ad1b6ca": "Improve GHSA-xvcm-6775-5m9r",
+      "6fcb15ca1eea57baf9ab2205d4ea704f78468e4c": "Improve GHSA-xvcm-6775-5m9r",
+      "f12cc7d4a20c66a834fdeba416d9ec00d02269ef": "Improve GHSA-xvcm-6775-5m9r",
+      "9ff0d0e02b90d11f5d4866e2a8a6581f46920996": "Improve GHSA-xvcm-6775-5m9r",
+      "48aabe71f97d524eebb2df11c8559b2e0db6fd54": "Publish Advisories\n\nGHSA-qcxq-75wr-5cm8\nGHSA-7j4w-x8x8-5mvg\nGHSA-xvcm-6775-5m9r\nGHSA-4x9g-vw65-vvf9",
+      "d4e2196ceafb139802f6ffd1005691ff1a777bac": "Publish Advisories\n\nGHSA-4c8g-83qw-93j6\nGHSA-xvcm-6775-5m9r"
+    },
+    "GHSA-CRF3-V9RR-V7HJ": {
+      "7e7f325fd5513fa1a45fdce9bc1dac901a1c90b4": "Improve GHSA-crf3-v9rr-v7hj",
+      "dd3912518a8367aded884464dd5d249f0f1d7446": "Publish Advisories\n\nGHSA-crf3-v9rr-v7hj\nGHSA-7wmf-pw8j-mc78\nGHSA-c9w5-rwh3-7pm9\nGHSA-hhmc-q9hp-r662\nGHSA-mmj4-63m4-r6h5",
+      "13b01afca62a337d572e92cc97c348ee659e7654": "Merge pull request #9006 from timtebeek/timtebeek-GHSA-crf3-v9rr-v7hj",
+      "431100c3671207c5f8669ca38cc864a3e68553b1": "Add affected Maven package and version range to GHSA-crf3-v9rr-v7hj",
+      "e34faa994a969a96da73434c6e96d687fa245753": "Publish Advisories\n\nGHSA-332v-fh8c-j8r7\nGHSA-359c-qmw4-f7gf\nGHSA-48px-72pc-9gfw\nGHSA-683g-rp82-2xcr\nGHSA-6p99-w6f4-qcvq\nGHSA-7h94-344f-429f\nGHSA-8mjr-j93g-6x4q\nGHSA-8p8v-838m-f36p\nGHSA-9vh2-928p-mm63\nGHSA-crf3-v9rr-v7hj\nGHSA-gm4w-wf6f-2ghm\nGHSA-h7w8-vg64-36f2\nGHSA-j58f-rgm2-v2p8\nGHSA-j6qh-f45v-j454\nGHSA-mr6p-pxvc-7864\nGHSA-q3h2-8p56-9cg6\nGHSA-q9pq-xp5c-jmhr\nGHSA-w2pp-vvh7-8jx9\nGHSA-x9fx-2h43-2prm"
+    },
+    "GHSA-28WG-GHJ8-5HJV": {
+      "88383e634539fdbeea76c0d81ea85f46b32a63ee": "Improve GHSA-28wg-ghj8-5hjv",
+      "95c9fc812ec5669683acefd1d20ff9586fef36c8": "Publish Advisories\n\nGHSA-5p2g-fcmc-qvqq\nGHSA-w3rx-r6r6-pgpr\nGHSA-28wg-ghj8-5hjv"
+    },
     "GHSA-2C6V-2QQC-6C65": {
       "72cb3cba000a381a2505884c74bb9dcb0723cdf7": "Publish Advisories\n\nGHSA-2c6v-2qqc-6c65\nGHSA-x764-fvmq-4x2r\nGHSA-3j2w-rmqf-7fcr\nGHSA-5wcc-3m77-2xf5\nGHSA-699f-5qvf-vjwg\nGHSA-925j-5vcw-p5xw\nGHSA-wcxv-276h-p3w8\nGHSA-wvcq-2rcq-fqc9"
     },
@@ -588,13 +623,6 @@
     "GHSA-C9FF-59G8-M36Q": {
       "202e0b609dcb907e4abdf923925915f89fbec96f": "Improve GHSA-c9ff-59g8-m36q"
     },
-    "GHSA-XVCM-6775-5M9R": {
-      "6fcb15ca1eea57baf9ab2205d4ea704f78468e4c": "Improve GHSA-xvcm-6775-5m9r",
-      "f12cc7d4a20c66a834fdeba416d9ec00d02269ef": "Improve GHSA-xvcm-6775-5m9r",
-      "9ff0d0e02b90d11f5d4866e2a8a6581f46920996": "Improve GHSA-xvcm-6775-5m9r",
-      "48aabe71f97d524eebb2df11c8559b2e0db6fd54": "Publish Advisories\n\nGHSA-qcxq-75wr-5cm8\nGHSA-7j4w-x8x8-5mvg\nGHSA-xvcm-6775-5m9r\nGHSA-4x9g-vw65-vvf9",
-      "d4e2196ceafb139802f6ffd1005691ff1a777bac": "Publish Advisories\n\nGHSA-4c8g-83qw-93j6\nGHSA-xvcm-6775-5m9r"
-    },
     "GHSA-72Q8-9RGW-5G6J": {
       "c41add544f28c5688825adf0c802d4d706ac5c11": "Improve GHSA-72q8-9rgw-5g6j"
     },
@@ -6805,9 +6833,6 @@
     "GHSA-W3RX-R6R6-PGPR": {
       "95c9fc812ec5669683acefd1d20ff9586fef36c8": "Publish Advisories\n\nGHSA-5p2g-fcmc-qvqq\nGHSA-w3rx-r6r6-pgpr\nGHSA-28wg-ghj8-5hjv"
     },
-    "GHSA-28WG-GHJ8-5HJV": {
-      "95c9fc812ec5669683acefd1d20ff9586fef36c8": "Publish Advisories\n\nGHSA-5p2g-fcmc-qvqq\nGHSA-w3rx-r6r6-pgpr\nGHSA-28wg-ghj8-5hjv"
-    },
     "GHSA-V2W2-W228-C444": {
       "03dba58c5cd736717b214ae78b10202ebb709f3a": "Publish Advisories\n\nGHSA-v2w2-w228-c444\nGHSA-m8wh-29wm-52mv\nGHSA-v2w2-w228-c444",
       "cdfc8886d71af7ef3bdab3e4db46753ff8af6538": "Publish GHSA-v2w2-w228-c444"
@@ -6895,12 +6920,6 @@
     "GHSA-GM37-52C6-37MW": {
       "900f05aada595e7b094178bdc32b4c4cb81e9efb": "Publish GHSA-gm37-52c6-37mw"
     },
-    "GHSA-CRF3-V9RR-V7HJ": {
-      "dd3912518a8367aded884464dd5d249f0f1d7446": "Publish Advisories\n\nGHSA-crf3-v9rr-v7hj\nGHSA-7wmf-pw8j-mc78\nGHSA-c9w5-rwh3-7pm9\nGHSA-hhmc-q9hp-r662\nGHSA-mmj4-63m4-r6h5",
-      "13b01afca62a337d572e92cc97c348ee659e7654": "Merge pull request #9006 from timtebeek/timtebeek-GHSA-crf3-v9rr-v7hj",
-      "431100c3671207c5f8669ca38cc864a3e68553b1": "Add affected Maven package and version range to GHSA-crf3-v9rr-v7hj",
-      "e34faa994a969a96da73434c6e96d687fa245753": "Publish Advisories\n\nGHSA-332v-fh8c-j8r7\nGHSA-359c-qmw4-f7gf\nGHSA-48px-72pc-9gfw\nGHSA-683g-rp82-2xcr\nGHSA-6p99-w6f4-qcvq\nGHSA-7h94-344f-429f\nGHSA-8mjr-j93g-6x4q\nGHSA-8p8v-838m-f36p\nGHSA-9vh2-928p-mm63\nGHSA-crf3-v9rr-v7hj\nGHSA-gm4w-wf6f-2ghm\nGHSA-h7w8-vg64-36f2\nGHSA-j58f-rgm2-v2p8\nGHSA-j6qh-f45v-j454\nGHSA-mr6p-pxvc-7864\nGHSA-q3h2-8p56-9cg6\nGHSA-q9pq-xp5c-jmhr\nGHSA-w2pp-vvh7-8jx9\nGHSA-x9fx-2h43-2prm"
-    },
     "GHSA-7WMF-PW8J-MC78": {
       "dd3912518a8367aded884464dd5d249f0f1d7446": "Publish Advisories\n\nGHSA-crf3-v9rr-v7hj\nGHSA-7wmf-pw8j-mc78\nGHSA-c9w5-rwh3-7pm9\nGHSA-hhmc-q9hp-r662\nGHSA-mmj4-63m4-r6h5"
     },
@@ -10453,9 +10472,6 @@
     "GHSA-M254-GMQ9-65XP": {
       "1721417c5dc7c1cbf858e5ea5a5245ea62e70cce": "Publish Advisories\n\nGHSA-4m7v-hj47-rqcr\nGHSA-4r37-9m26-2c4m\nGHSA-7hfj-8497-9m6v\nGHSA-cjff-5v28-x7h8\nGHSA-fcfg-fr25-xwpr\nGHSA-m254-gmq9-65xp\nGHSA-px8p-9vwx-vf98\nGHSA-qjw4-6j2q-9mgr\nGHSA-v36m-hw3w-whpw\nGHSA-wpwx-q57v-jhwg"
     },
-    "GHSA-PX8P-9VWX-VF98": {
-      "1721417c5dc7c1cbf858e5ea5a5245ea62e70cce": "Publish Advisories\n\nGHSA-4m7v-hj47-rqcr\nGHSA-4r37-9m26-2c4m\nGHSA-7hfj-8497-9m6v\nGHSA-cjff-5v28-x7h8\nGHSA-fcfg-fr25-xwpr\nGHSA-m254-gmq9-65xp\nGHSA-px8p-9vwx-vf98\nGHSA-qjw4-6j2q-9mgr\nGHSA-v36m-hw3w-whpw\nGHSA-wpwx-q57v-jhwg"
-    },
     "GHSA-QJW4-6J2Q-9MGR": {
       "1721417c5dc7c1cbf858e5ea5a5245ea62e70cce": "Publish Advisories\n\nGHSA-4m7v-hj47-rqcr\nGHSA-4r37-9m26-2c4m\nGHSA-7hfj-8497-9m6v\nGHSA-cjff-5v28-x7h8\nGHSA-fcfg-fr25-xwpr\nGHSA-m254-gmq9-65xp\nGHSA-px8p-9vwx-vf98\nGHSA-qjw4-6j2q-9mgr\nGHSA-v36m-hw3w-whpw\nGHSA-wpwx-q57v-jhwg"
     },

data/fix-commits/druid-612f0710.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/apache/druid",
   "vulnerabilities": {
+    "GHSA-W5HQ-G745-H8PQ": {
+      "87344823a6744c7818268158088bf376b14ca398": "Suppress uuid GHSA-w5hq-g745-h8pq (not applicable to Druid)\n\nDruid's web console only calls uuidv4() with no buf argument, so the\nvulnerable v3/v5/v6 code path is never exercised.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>"
+    },
     "CVE-2026-42583": {
       "43278bce1b6b516837798455cf6211ecb4063780": "build(deps): Update Netty to 4.2.15.Final to address multiple CVEs (#19566)\n\n* Update Netty to 4.2.14.Final to address multiple CVEs\n\nThis update addresses 17 critical and high severity CVEs in Netty:\n\n- CVE-2026-42583: Lz4FrameDecoder resource exhaustion (HIGH)\n- CVE-2026-42579: HTTP response desynchronization (HIGH)\n- CVE-2026-42585: MQTT resource exhaustion (MODERATE)\n- CVE-2026-33870: HTTP request smuggling via quoted strings (HIGH)\n- CVE-2025-67735: DNS codec validation bypass (HIGH)\n- CVE-2026-42587: HTTP/3 QPACK unbounded allocation (HIGH)\n- CVE-2026-41417: Epoll transport DoS via RST (HIGH)\n- CVE-2026-42584: HTTP request smuggling via Transfer-Encoding (MODERATE)\n- CVE-2026-42581: HTTP request smuggling via chunk size parsing (MODERATE)\n- CVE-2026-42580: Redis codec CRLF injection (MODERATE)\n- CVE-2026-33871: HTTP header injection via HttpProxyHandler (LOW)\n- CVE-2026-42582: Additional HTTP codec vulnerabilities\n- CVE-2026-44248: MQTT 5 decoder resource exhaustion (HIGH)\n- CVE-2026-42586: Additional resource consumption issues\n- CVE-2025-59419: Security improvements\n- CVE-2026-42578: Additional security fixes\n- CVE-2026-42577: Additional security fixes\n\nUpdated netty4.version from 4.2.12.Final to 4.2.14.Final.\nAll CVEs are fixed in version 4.2.13.Final and later.\n\n* Update licenses.yaml for Netty 4.2.14.Final\n\n* Add missing netty-codec-classes-quic to licenses.yaml\n\nThe Netty 4.2.14.Final upgrade introduced a new transitive dependency\nio.netty:netty-codec-classes-quic which was missing from the licenses.yaml\nfile, causing license validation failures in CI.\n\nThis module provides QUIC protocol codec support and is licensed under\nApache License version 2.0, consistent with all other Netty modules.\n\n* Upgrade Netty to 4.2.15.Final to address additional CVEs\n\nUpdates Netty from 4.2.14.Final to 4.2.15.Final to address 26 additional\ncritical security vulnerabilities discovered after the 4.2.14 release.\n\n* Properly document Javassist MPL 1.1 triple-licensing\n\nJavassist is triple-licensed under MPL 1.1, LGPL 2.1, and Apache License 2.0.\nApache Druid uses it under Apache 2.0 terms.\n\nChanges:\n1. Add MPL 1.1 as a recognized license in check-licenses.py\n2. Update Javassist entry in licenses.yaml to declare MPL 1.1 as its\n   primary license with a notice explaining the triple-licensing and that\n   we use it under Apache 2.0 terms\n\nThis addresses review feedback to properly canonicalize MPL 1.1 to its\nown license name rather than hiding it by mapping to Apache 2.0.\n\nAddresses: Review comment from FrankChen021 on PR #19566\n\n* Update netty-tcnative to 2.0.77.Final for azure-extensions\n\nNetty 4.2.15.Final pulls in netty-tcnative 2.0.77.Final as a transitive\ndependency in druid-azure-extensions. Update licenses.yaml to register\nthe new version.\n\n---------\n\nCo-authored-by: Ashwin Tumma <ashwin.tumma@salesforce.com>"
     },