From b1f5c8e250a01070526e114f31873fac1fe444da Mon Sep 17 00:00:00 2001
From: soumyadeep-roy <soumyadeep.roy@salesforce.com>
Date: Tue, 8 Sep 2026 16:26:23 +0530
Subject: [PATCH] [LIVY-1077] Bump jetty.version to latest 9.4.x
 (9.4.58.v20250814)

pom.xml currently pins jetty.version to 9.4.56.v20240826, which is
affected by CVE-2026-2332 / GHSA-355h-qmc2-wpwf (HTTP/1.1 request
smuggling via malformed chunk-extension quoted-string parsing in Jetty's
chunked transfer-encoding parser, CVSS 7.4 High, CWE-444).

Per OSV/GHSA-355h-qmc2-wpwf and Maven Central directly: the actual fix for
this CVE on the Jetty 9.4.x branch is version 9.4.60, but 9.4.59/9.4.60
have never been published to Maven Central -- the upstream Jetty advisory
itself still reads "No patches yet" for that branch. The only published
fixes are on Jetty 10.x/11.x/12.x, which require Java 11+ (12.x requires
Java 17+ and moves javax.servlet -> jakarta.servlet), a real migration
rather than a version-property bump.

Bumps jetty.version to 9.4.58.v20250814, the latest version actually
published on the 9.4.x branch, as defense-in-depth (picks up every other
9.4.x security fix since 9.4.56). CVE-2026-2332 itself remains open
pending an upstream Jetty 9.4.x patch release, or a separately-scoped move
to Jetty 10+/Java 11+.
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 738c166ae..bca4b0e69 100644
--- a/pom.xml
+++ b/pom.xml
@@ -93,7 +93,7 @@
     <jackson-databind.version>2.12.7.1</jackson-databind.version>
     <jacoco.version>0.8.13</jacoco.version>
     <javax.servlet-api.version>3.1.0</javax.servlet-api.version>
-    <jetty.version>9.4.56.v20240826</jetty.version>
+    <jetty.version>9.4.58.v20250814</jetty.version>
     <junit.version>4.13.1</junit.version>
     <libthrift.version>0.9.3</libthrift.version>
     <log4j.version>2.26.0</log4j.version>