From 19a24fcc7a1fec5dbc2c139561e319b92f840452 Mon Sep 17 00:00:00 2001
From: Heather Zhang <111881174+heatherzh01@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:32:55 -0400
Subject: [PATCH 1/2] pin netty-handler to 4.1.137.Final for CVE-2026-62243
 (TLS hostname verification bypass)

---
 pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pom.xml b/pom.xml
index a0cf627e..ae23677f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,6 +20,13 @@
 
   <dependencyManagement>
     <dependencies>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-bom</artifactId>
+        <version>4.1.137.Final</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>${quarkus.platform.group-id}</groupId>
         <artifactId>${quarkus.platform.artifact-id}</artifactId>

From e083f998d050056f44c2cd76e0ebeb433798f6f5 Mon Sep 17 00:00:00 2001
From: Heather Zhang <111881174+heatherzh01@users.noreply.github.com>
Date: Mon, 7 Sep 2026 18:51:03 -0400
Subject: [PATCH 2/2] docs: document netty-bom pin rationale and removal
 tracking

---
 pom.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pom.xml b/pom.xml
index ae23677f..6ee51bef 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,6 +20,19 @@
 
   <dependencyManagement>
     <dependencies>
+      <!--
+        CVE-2026-62243: Netty TLS hostname verification bypass on the
+        SslProvider.OPENSSL client path (fixed in netty 4.1.137.Final).
+        Quarkus 3.36.2's quarkus-bom manages netty 4.1.135.Final, which is
+        vulnerable, so this netty-bom is imported BEFORE quarkus-bom to force
+        all io.netty artifacts to 4.1.137.Final (first-declared import BOM wins).
+
+        TEMPORARY: remove this import once the platform's quarkus.platform.version
+        manages netty-handler >= 4.1.137.Final; leaving it pinned would silently
+        cap netty below any newer version Quarkus ships and could re-expose us to
+        future CVEs. Removal tracked by: TC-6098
+        (https://redhat.atlassian.net/browse/TC-6098).
+      -->
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-bom</artifactId>