From c5e9901ed1b3e9be2aae9364c8c90c12083ee46d Mon Sep 17 00:00:00 2001
From: Will Mooreston <willm@labkey.com>
Date: Thu, 9 Jul 2026 13:42:35 -0700
Subject: [PATCH 1/2] suppress false positive CVE-2026-54428

---
 dependencyCheckSuppression.xml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index 4c5e10925c..cc31a5443f 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -438,14 +438,15 @@
         <cve>CVE-2025-15104</cve>
     </suppress>
     <!--
-    CVE-2026-54399 is scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, is not listed as affected, and has no fixed 4.4.x release. False positive for the 4.x artifact.
+    CVE-2026-54399 (httpcore5 HTTP/1.1 parser) and CVE-2026-54428 (httpcore5-h2 HTTP/2 HPACK decoder) are both scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, has no HTTP/2 module, is not listed as affected, and has no fixed 4.4.x release. False positives for the 4.x artifact.
     -->
     <suppress>
         <notes><![CDATA[
-    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVE)
+    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVEs)
     ]]></notes>
         <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
         <cve>CVE-2026-54399</cve>
+        <cve>CVE-2026-54428</cve>
     </suppress>
     <!--
     CVE-2026-53914 is in the Kotlin compiler's build-cache deserialization. We don't compile Kotlin or use the Kotlin build

From ce5a1374f9b13d093ee8e131be842e153f94fbab Mon Sep 17 00:00:00 2001
From: Will Mooreston <willm@labkey.com>
Date: Thu, 9 Jul 2026 14:03:24 -0700
Subject: [PATCH 2/2] Force httpcore5-h2 to 5.4.3 for CVE-2026-54399/54428
 remediation

The resolutionStrategy force block pinned httpcore5 (5.4.3) and httpclient5 (5.5.2) but not httpcore5-h2, which resolved transitively to 5.3.6 and remained flagged by OWASP dependency-check for CVE-2026-54399 (HTTP/1.1 parser DoS) and CVE-2026-54428 (HTTP/2 HPACK decoder DoS). Both are scoped to Apache HttpComponents Core up to and including 5.4.2; aligning httpcore5-h2 to httpcore5Version (5.4.3) resolves them. Shaded copies originating from labkey-api-jdbc are addressed separately.
---
 build.gradle | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/build.gradle b/build.gradle
index 8c7c36b0ed..92e9976b6d 100644
--- a/build.gradle
+++ b/build.gradle
@@ -248,6 +248,8 @@ allprojects {
                     // force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
                     force "org.apache.httpcomponents:httpcore:${httpcoreVersion}"
                     force "org.apache.httpcomponents.core5:httpcore5:${httpcore5Version}"
+                    // align httpcore5-h2 with httpcore5; the transitive 5.3.6 is exposed to CVE-2026-54399/CVE-2026-54428 (fixed in 5.4.3)
+                    force "org.apache.httpcomponents.core5:httpcore5-h2:${httpcore5Version}"
                     // force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
                     force "org.apache.httpcomponents:httpclient:${httpclientVersion}"
                     force "org.apache.httpcomponents.client5:httpclient5:${httpclient5Version}"