finagle/finagle-serversets: Update commons-lang to 3.18.0 #973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

raihio wants to merge 1 commit into twitter:develop from raihio:finagle/finagle-serversets/UpdateCommonsLang

+6 −5

raihio commented Jul 15, 2025 •

edited

Loading

Problem

finagle-serversets uses commons-lang version 2.6 which contains CVE-2025-48924
- https://nvd.nist.gov/vuln/detail/CVE-2025-48924
- https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1
commons-lang version 2.6 is deprecated and has not received an update since 2011-01-16
- https://commons.apache.org/proper/commons-lang/changes.html

Solution

Migrate commons-lang to org.apache.commons.lang3 and update version to 3.18.0
change old org.apache.commons.lang imports to org.apache.commons.lang3

Result

finagle-serversets no longer contains CVE-2025-48924


          finagle/finagle-serversets: Update commons-lang to 3.18.0

b79eb30

CLAassistant commented Jul 15, 2025 •

edited

Loading

All committers have signed the CLA.

Author

raihio commented Jul 16, 2025

Hi @mbezoyan @tapans when you have a moment, I’d appreciate your review. Thanks!

aforloney commented Oct 16, 2025

Bumping this for review @mbezoyan @tapans as it involves an active vulnerability

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment