From 9d7b4dacbc7f15115e19c75081d9c8656c43239a Mon Sep 17 00:00:00 2001
From: guoqiang <guoqiang@selectdb.com>
Date: Thu, 20 Aug 2026 20:01:49 +0800
Subject: [PATCH 1/2] [fix](fe) Replace vulnerable Bouncy Castle provider

Exclude the obsolete bcprov-jdk15on dependency pulled by Huawei IAM and use bcprov-jdk18on 1.78.1 instead to address CVE-2023-33202.
---
 fe/fe-core/pom.xml | 10 ++++++++++
 fe/pom.xml         | 10 ++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index 2a0cc1d8224e1c..d937a2deb68dcc 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -420,6 +420,10 @@ under the License.
             <groupId>com.huaweicloud.sdk</groupId>
             <artifactId>huaweicloud-sdk-iam</artifactId>
             <exclusions>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>com.squareup.okhttp3</groupId>
                     <artifactId>okhttp</artifactId>
@@ -430,6 +434,12 @@ under the License.
                 </exclusion>
             </exclusions>
         </dependency>
+        <!-- Replace Huawei IAM's bcprov-jdk15on 1.69/1.70 with 1.78.1 from the maintained
+             jdk18on line; versions before 1.73 are affected by CVE-2023-33202. -->
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk18on</artifactId>
+        </dependency>
         <!-- ICU4J for unicode normalization -->
         <dependency>
             <groupId>com.ibm.icu</groupId>
diff --git a/fe/pom.xml b/fe/pom.xml
index 0ed9e5bdba0e77..0dcf6e9d376da3 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -374,7 +374,9 @@ under the License.
         <zookeeper.version>3.9.3</zookeeper.version>
         <velocity-engine-core.version>2.4</velocity-engine-core.version>
         <ranger-plugins-common.version>2.8.0</ranger-plugins-common.version>
-        <bcprov-jdk15on.version>1.70</bcprov-jdk15on.version>
+        <!-- Huawei IAM pulls bcprov-jdk15on 1.69, whose final 1.70 release is vulnerable to
+             CVE-2023-33202. Use the compatible jdk18on line at 1.78.1, which contains the fix. -->
+        <bcprov-jdk18on.version>1.78.1</bcprov-jdk18on.version>
         <woodstox.version>6.5.1</woodstox.version>
         <kerby.version>2.0.3</kerby.version>
         <jettison.version>1.5.4</jettison.version>
@@ -613,11 +615,11 @@ under the License.
                 <artifactId>woodstox-core</artifactId>
                 <version>${woodstox.version}</version>
             </dependency>
-            <!-- bcprov-jdk15on -->
+            <!-- Replacement for Huawei IAM's vulnerable bcprov-jdk15on dependency. -->
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcprov-jdk15on</artifactId>
-                <version>${bcprov-jdk15on.version}</version>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>${bcprov-jdk18on.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>

From 9803867672f2aa8b70ca62664792a5714c2cb4db Mon Sep 17 00:00:00 2001
From: guoqiang <guoqiang@selectdb.com>
Date: Thu, 20 Aug 2026 21:01:33 +0800
Subject: [PATCH 2/2] [fix](fe) Upgrade vulnerable dependencies

Upgrade the FE dependency set to releases containing the published security fixes, align Jetty core and EE10 artifacts, migrate LZ4 to its maintained coordinate, and update Maven Shade for Jackson Java 21 classes. Document every version change in the POMs. Thrift remains out of scope.
---
 fe/fe-core/pom.xml  | 10 ++++-
 fe/hive-udf/pom.xml |  1 -
 fe/pom.xml          | 98 ++++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 100 insertions(+), 9 deletions(-)

diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index d937a2deb68dcc..ef7b93414efe37 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -372,6 +372,12 @@ under the License.
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-jetty</artifactId>
         </dependency>
+        <!-- Jetty 12.0.38 calls Jakarta Servlet 6.1 APIs when writing Set-Cookie headers. -->
+        <dependency>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
+            <version>${jakarta.servlet-api.version}</version>
+        </dependency>
         <!-- File Upload -->
         <dependency>
             <groupId>commons-fileupload</groupId>
@@ -434,8 +440,8 @@ under the License.
                 </exclusion>
             </exclusions>
         </dependency>
-        <!-- Replace Huawei IAM's bcprov-jdk15on 1.69/1.70 with 1.78.1 from the maintained
-             jdk18on line; versions before 1.73 are affected by CVE-2023-33202. -->
+        <!-- Replace Huawei IAM's bcprov-jdk15on 1.69/1.70 with 1.84 from the maintained
+             jdk18on line; it fixes CVE-2023-33202 and the later 2025/2026 BC Java advisories. -->
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk18on</artifactId>
diff --git a/fe/hive-udf/pom.xml b/fe/hive-udf/pom.xml
index a30a2a5ac6fed1..83bb1f7c42f1f2 100644
--- a/fe/hive-udf/pom.xml
+++ b/fe/hive-udf/pom.xml
@@ -119,7 +119,6 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
-                <version>3.6.0</version>
                 <configuration>
                     <minimizeJar>true</minimizeJar>
                     <relocations>
diff --git a/fe/pom.xml b/fe/pom.xml
index 0dcf6e9d376da3..1a4d955d6704ec 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -205,6 +205,11 @@ under the License.
                         </execution>
                     </executions>
                 </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-shade-plugin</artifactId>
+                    <version>${maven-shade-plugin.version}</version>
+                </plugin>
             </plugins>
         </pluginManagement>
         <extensions>
@@ -267,9 +272,16 @@ under the License.
         <commons-validator.version>1.9.0</commons-validator.version>
         <gson.version>2.10.1</gson.version>
         <guava.version>33.2.1-jre</guava.version>
-        <jackson.version>2.16.0</jackson.version>
+        <!-- Jackson 2.16.0 is affected by multiple 2026 parser and polymorphic-deserialization
+             vulnerabilities, including CVE-2026-54512. Version 2.21.5 contains the complete fixes. -->
+        <jackson.version>2.21.5</jackson.version>
         <javassist.version>3.18.2-GA</javassist.version>
         <javax.servlet-api.version>3.1.0</javax.servlet-api.version>
+        <!-- Jetty 12.0.38 (jetty-ee10-servlet) invokes jakarta.servlet.http.Cookie#getAttributes(),
+             which only exists since Jakarta Servlet 6.1. Pin the API to 6.1.0 so it matches the
+             jetty version; otherwise the transitive 6.0.0 from spring-boot triggers NoSuchMethodError
+             when the FE HTTP server writes a Set-Cookie (SameSite) header. -->
+        <jakarta.servlet-api.version>6.1.0</jakarta.servlet-api.version>
         <je.version>18.3.14-doris-SNAPSHOT</je.version>
         <jmockit.version>1.49</jmockit.version>
         <commons-io.version>2.18.0</commons-io.version>
@@ -287,6 +299,9 @@ under the License.
         <resilience4j.version>2.4.0</resilience4j.version>
         <!-- Keep Netty compatible with Arrow Flight SQL 19 and other transitive Netty users. -->
         <netty-all.version>4.2.15.Final</netty-all.version>
+        <!-- OpenTelemetry versions before 1.62.0 allow unbounded allocation while parsing W3C
+             baggage (CVE-2026-45292); align the complete OpenTelemetry graph on the fixed BOM. -->
+        <opentelemetry.version>1.62.0</opentelemetry.version>
         <!--The dependence of transitive dependence cannot be ruled out, only Saving the nation through twisted ways.-->
         <netty-3-test.version>3.10.6.Final</netty-3-test.version>
         <objenesis.version>2.1</objenesis.version>
@@ -355,6 +370,11 @@ under the License.
         <hamcrest.version>2.1</hamcrest.version>
         <httpclient.version>4.5.13</httpclient.version>
         <httpcore.version>4.4.15</httpcore.version>
+        <!-- HttpClient 5.5.2 can leak pooled connections on decode errors (CVE-2026-64607),
+             and HttpCore 5.3.6 is affected by HTTP/1 and HTTP/2 memory-exhaustion issues
+             (CVE-2026-54399 and CVE-2026-54428). Use their fixed maintenance releases. -->
+        <httpclient5.version>5.6.3</httpclient5.version>
+        <httpcore5.version>5.4.3</httpcore5.version>
         <aws-java-sdk.version>1.12.669</aws-java-sdk.version>
         <mariadb-java-client.version>3.0.9</mariadb-java-client.version>
         <postgresql.version>42.7.13</postgresql.version>
@@ -368,20 +388,32 @@ under the License.
         <antlr4.version>4.13.1</antlr4.version>
         <joda.version>2.8.1</joda.version>
         <project.scm.id>github</project.scm.id>
-        <spring.version>3.5.14</spring.version>
-        <spring-framework.version>6.2.18</spring-framework.version>
+        <!-- Spring Boot 3.5.16 manages fixed Spring LDAP 3.3.8, Spring Data 3.5.13,
+             Micrometer 1.15.12, and Logback 1.5.34 releases for their 2026 advisories. -->
+        <spring.version>3.5.16</spring.version>
+        <!-- Spring Framework 6.2.19 fixes the June 2026 security advisory set, including
+             CVE-2026-41848; keep the explicit framework BOM aligned with that release. -->
+        <spring-framework.version>6.2.19</spring-framework.version>
         <orc.version>1.8.4</orc.version>
         <zookeeper.version>3.9.3</zookeeper.version>
         <velocity-engine-core.version>2.4</velocity-engine-core.version>
         <ranger-plugins-common.version>2.8.0</ranger-plugins-common.version>
         <!-- Huawei IAM pulls bcprov-jdk15on 1.69, whose final 1.70 release is vulnerable to
-             CVE-2023-33202. Use the compatible jdk18on line at 1.78.1, which contains the fix. -->
-        <bcprov-jdk18on.version>1.78.1</bcprov-jdk18on.version>
+             CVE-2023-33202. Use the compatible jdk18on line at 1.84, which also fixes
+             CVE-2025-14813, CVE-2026-0636, CVE-2026-3505, CVE-2026-5588, and CVE-2026-5598. -->
+        <bcprov-jdk18on.version>1.84</bcprov-jdk18on.version>
         <woodstox.version>6.5.1</woodstox.version>
         <kerby.version>2.0.3</kerby.version>
         <jettison.version>1.5.4</jettison.version>
-        <jetty.version>12.0.29</jetty.version>
+        <!-- Jetty 12.0.34 is affected by CVE-2026-6790, CVE-2026-8384,
+             CVE-2026-10050, and CVE-2026-10051; 12.0.38 contains all published fixes. -->
+        <jetty.version>12.0.38</jetty.version>
         <jetty-http.version>11.0.26</jetty-http.version>
+        <!-- org.lz4:lz4-java is archived and vulnerable through its final 1.8.x line.
+             Resolve its official 1.8.1 relocation POM, then manage the maintained coordinate at
+             1.11.1 to fix CVE-2025-12183, CVE-2025-66566, and CVE-2026-59949. -->
+        <lz4-java-relocation.version>1.8.1</lz4-java-relocation.version>
+        <lz4-java.version>1.11.1</lz4-java.version>
         <immutables.version>2.9.3</immutables.version> 
         <ivy.version>2.5.2</ivy.version>
         <icu4j.version>78.1</icu4j.version>
@@ -396,6 +428,10 @@ under the License.
         <arrow.vector.classifier>shade-format-flatbuffers</arrow.vector.classifier>
         <flatbuffers.version>1.12.0</flatbuffers.version>
         <jacoco.version>0.8.10</jacoco.version>
+        <!-- Maven Shade 3.4.1 cannot parse the Java 21 multi-release classes shipped by
+             Jackson 2.21.x. Version 3.6.2 uses a current ASM release that supports them. -->
+        <maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
+        <argLine></argLine>
         <trino.version>435</trino.version>
         <nimbusds.version>10.0.1</nimbusds.version>
         <jakarta.annotation-api.version>2.1.1</jakarta.annotation-api.version>
@@ -463,6 +499,14 @@ under the License.
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Keep all OpenTelemetry API, SDK, and exporter artifacts on the CVE-2026-45292-fixed line. -->
+            <dependency>
+                <groupId>io.opentelemetry</groupId>
+                <artifactId>opentelemetry-bom</artifactId>
+                <version>${opentelemetry.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson</groupId>
                 <artifactId>jackson-bom</artifactId>
@@ -470,6 +514,33 @@ under the License.
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
+            <!-- Override Spring Boot's vulnerable HttpComponents 5 versions. -->
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>${httpclient5.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5</artifactId>
+                <version>${httpcore5.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5-h2</artifactId>
+                <version>${httpcore5.version}</version>
+            </dependency>
+            <!-- First redirect archived org.lz4 dependencies, then select the fixed maintained release. -->
+            <dependency>
+                <groupId>org.lz4</groupId>
+                <artifactId>lz4-java</artifactId>
+                <version>${lz4-java-relocation.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>at.yawk.lz4</groupId>
+                <artifactId>lz4-java</artifactId>
+                <version>${lz4-java.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.ivy</groupId>
                 <artifactId>ivy</artifactId>
@@ -510,6 +581,15 @@ under the License.
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
+            <!-- The core Jetty BOM does not manage Jakarta EE 10 artifacts; import the matching
+                 EE10 BOM before Spring Boot so the complete Jetty 12 graph stays on 12.0.38. -->
+            <dependency>
+                <groupId>org.eclipse.jetty.ee10</groupId>
+                <artifactId>jetty-ee10-bom</artifactId>
+                <version>${jetty.version}</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
             <dependency>
                 <groupId>org.eclipse.jetty.http2</groupId>
                 <artifactId>http2-client</artifactId>
@@ -1815,6 +1895,12 @@ under the License.
                         <groupId>com.squareup.okio</groupId>
                         <artifactId>okio</artifactId>
                     </exclusion>
+                    <!-- Trino 435 pulls a Servlet 5.0 API repackage that shadows Jakarta Servlet
+                         6.1 on the FE classpath and breaks Jetty 12.0.38 cookie handling. -->
+                    <exclusion>
+                        <groupId>org.eclipse.jetty.toolchain</groupId>
+                        <artifactId>jetty-jakarta-servlet-api</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>