[NO-ISSUE]: upgrade log4j-api to 2.26.1 in to address cve - #6869
Open
athirakm94 wants to merge 2 commits into
Open
[NO-ISSUE]: upgrade log4j-api to 2.26.1 in to address cve#6869athirakm94 wants to merge 2 commits into
athirakm94 wants to merge 2 commits into
Conversation
CVE-2026-49844 affects org.apache.logging.log4j:log4j-api versions below 2.25.5. Two vulnerable version paths were identified: 1. Spring Boot path (log4j-api:2.25.4) spring-boot-dependencies:4.0.7 sets log4j2.version=2.25.4 and hardcodes log4j-api/log4j-to-slf4j/log4j-jul at that version in its dependencyManagement. Fix applied in kogito-spring-boot-bom: - Add <log4j2.version>2.26.1</log4j2.version> property override - Add explicit log4j-api, log4j-to-slf4j, log4j-jul managed entries BEFORE the spring-boot-dependencies import (Maven first-declaration- wins rule overrides the hardcoded 2.25.4 in the imported BOM) 2. OptaPlanner/Quarkus path (log4j-api:2.25.1) quarkus-bom:3.27.4.1 manages log4j-api:2.25.1 which is promoted into the resolved classpath via optaplanner-examples' direct dependency on log4j-to-slf4j. Fix applied in optaplanner-build-parent: - Upgrade version.org.apache.logging.log4j from 2.22.1 to 2.26.1 - Add explicit log4j-api managed entry to override quarkus-bom's 2.25.1 Affected modules (before -> after): drools-rules-spring-boot-starter: log4j-api:2.25.4 -> 2.26.1 kogito-spring-boot-starter: log4j-api:2.25.4 -> 2.26.1 data-index-common-springboot: log4j-api:2.25.4 -> 2.26.1 data-index-graphql-addons-springboot: log4j-api:2.25.4 -> 2.26.1 optaplanner-examples: log4j-api:2.25.1 -> 2.26.1 No changes required in incubator-kie-kogito-examples or incubator-kie-tools (fix propagates from this upstream BOM). Quarkus modules are not affected (log4j-api never resolves to classpath; Quarkus uses JBoss LogManager). Ref: https://logging.apache.org/security.html#CVE-2026-49844
athirakm94
force-pushed
the
cve-fix-logapi
branch
from
August 4, 2026 13:08
06431b3 to
992d3a7
Compare
yesamer
requested review from
gitgabrio and
yesamer
and removed request for
gitgabrio
August 4, 2026 18:18
gitgabrio
requested changes
Aug 5, 2026
gitgabrio
left a comment
gitgabrio
left a comment
Contributor
There was a problem hiding this comment.
Hi @athirakm94
Thanks for the PR.
Anyway, I would kindly ask you to look things at bigger level, i.e.
- long terms maintenance
- overall design
About 1: lot of effort and time has been dedicated to have one single "pom" file that could be easy to be read and maintained, and keep things ordered is one of the main feature
About 2: please notice how maven inheritance/versioning works, and how similar overrides have been done.
Thanks!
@yesamer FYI ^^
| quarkus-bom:3.27.4.1 promotes it to 2.25.1. Both are below the minimum safe version 2.25.5. | ||
| This managed entry forces 2.26.1 across all modules inheriting kie-parent. | ||
| https://logging.apache.org/security.html#CVE-2026-49844 --> | ||
| <version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j> |
Contributor
There was a problem hiding this comment.
HI @athirakm94
Please keep the versions ordered, otherwise this file will become a nightmare to manage.
I spent a huge amount of time exactly for that reason 😄
| <artifactId>log4j-over-slf4j</artifactId> | ||
| <version>${version.org.slf4j}</version> | ||
| </dependency> | ||
| <dependency> |
Contributor
There was a problem hiding this comment.
HI @athirakm94
Please keep the versions ordered, otherwise this file will become a nightmare to manage.
I spent a huge amount of time exactly for that reason 😄
| <!-- CVE-2026-49844: override log4j2.version used by spring-boot-dependencies BOM (log4j-bom import). | ||
| Spring Boot 4.0.7 sets log4j2.version=2.25.4 which is vulnerable; upgrade to 2.26.1 (minimum 2.25.5). | ||
| https://logging.apache.org/security.html#CVE-2026-49844 --> | ||
| <log4j2.version>2.26.1</log4j2.version> |
Contributor
There was a problem hiding this comment.
HI @athirakm94
This is the wrong approach.
To override the versions, you just need to override the variable, i.e.
<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
| imports. Maven's first-declaration-wins rule means these entries take precedence over the hardcoded | ||
| log4j-api/log4j-to-slf4j/log4j-jul:2.25.4 versions inside spring-boot-dependencies-4.0.7.pom. | ||
| https://logging.apache.org/security.html#CVE-2026-49844 --> | ||
| <dependency> |
Contributor
There was a problem hiding this comment.
@athirakm94
Those are not needed - the only required change is the override of the version property
…9844 Two additional vulnerable transitive paths were identified in the full dependency tree (test.txt): 1. poi-ooxml path (log4j-api:2.24.3) poi-ooxml:5.4.1 imports log4j-bom:2.24.3 and declares log4j-api as a direct compile dependency with no explicit version — resolved to 2.24.3 from its own BOM. Affects: - drools-decisiontables, kie-maven-plugin, kogito-maven-plugin - Drools examples, DMN validation, xls2dmn, Impact Analysis - Kogito Gradle Plugin, and all modules using drools-decisiontables 2. quarkus-bom path (log4j-api:2.25.1) quarkus-bom:3.27.4.1 manages log4j-api:2.25.1 directly. This wins over poi's 2.24.3 in quarkus modules. Affects: - drools-quarkus-integration-test (and variants) - jBPM/Drools/Kogito Quarkus extension integration tests Fix: add version.org.apache.logging.log4j=2.26.1 property and an explicit log4j-api managed entry in kie-parent/pom.xml dependencyManagement. kie-parent is the common root for all drools, dmn, pmml, maven-plugin, and quarkus modules; a single entry here overrides both the poi-ooxml and quarkus-bom transitive versions. Before / after (all modules): log4j-api:2.24.3 (poi-ooxml path) -> 2.26.1 log4j-api:2.25.1 (quarkus-bom path) -> 2.26.1 Previously fixed (commit 637b75d): log4j-api:2.25.4 (spring-boot path) -> 2.26.1 [kogito-spring-boot-bom] log4j-api:2.25.1 (optaplanner path) -> 2.26.1 [optaplanner-build-parent] Ref: https://logging.apache.org/security.html#CVE-2026-49844
athirakm94
force-pushed
the
cve-fix-logapi
branch
from
August 5, 2026 12:16
992d3a7 to
cdd1005
Compare
gitgabrio
approved these changes
Aug 5, 2026
gitgabrio
left a comment
gitgabrio
left a comment
Contributor
There was a problem hiding this comment.
Thanks @athirakm94 ❤️ !
yesamer
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
upgrade log4j-api to 2.26.1 in to address cve