Repository navigation
[Bug]: com.github.docker-java:docker-java-transport-zerodep pulls in apache httpcomponents which was tagged in CVE-2026-54428 #11973
Description
Module
Core
Testcontainers version
2.05
Using the latest Testcontainers version?
Yes
Host OS
Mac
Host Arch
ARM
Docker version
Client: Docker Engine - Community
Version: 29.6.2
API version: 1.55
Go version: go1.26.5
Git commit: dfc4efb1e2
Built: Thu Jul 16 16:09:24 2026
OS/Arch: darwin/arm64
Context: desktop-linux
Server: Docker Desktop 4.83.0 (234302)
Engine:
Version: 29.6.2
API version: 1.55 (minimum version 1.40)
Go version: go1.26.5
Git commit: 3d80467
Built: Thu Jul 16 16:13:03 2026
OS/Arch: linux/arm64
Experimental: false
containerd:
Version: v2.2.5
GitCommit: e53c7c1516c3b2bff98eb76f1f4117477e6f4e66
runc:
Version: 1.3.6
GitCommit: v1.3.6-0-g491b69ba
docker-init:
Version: 0.19.0
GitCommit: de40ad0What happened?
Please fix the security vulnerability
Relevant log output
Additional Information
No response
Activity
kiview commentedon Aug 24, 2026
While this triggers CVE scanners, it is not exploitable in tc-java. docker-java has a PR open, that should mitigate this finding: docker-java/docker-java#2669