transport-zerodep 3.7.1 bundles httpcore5 5.3.6 affected by CVE-2026-54399/CVE-2026-54428 (fixed in 5.4.3) — please cut a release with the fixed version #2672

Summary

com.github.docker-java:docker-java-transport-zerodep:3.7.1 (latest release) shades Apache httpcore5 5.3.6 (and httpclient5 5.5.1). httpcore5 up to and including 5.4.2 is affected by:

• CVE-2026-54399 — memory exhaustion DoS in the HTTP/1.1 message parser (GHSA-hf6x-8p5f-cgmf), fixed in 5.4.3;
• CVE-2026-54428 — memory exhaustion DoS in the HPACK decoder before the SETTINGS ACK (GHSA-v3jc-474w-2wm6), fixed in 5.4.3 (httpcore5-h2).

Because the classes are shaded into the zerodep artifact, downstream dependencyManagement pins cannot remediate this — only a new docker-java release embedding httpcore5/httpcore5-h2 ≥ 5.4.3 can. Both CVEs are CVSS 7.5 and fail any OWASP Dependency-Check gate with failBuildOnCVSS=7, including for every Testcontainers user (the latest Testcontainers release still depends on docker-java 3.7.1).

Evidence

$ unzip -p docker-java-transport-zerodep-3.7.1.jar \
    META-INF/maven/org.apache.httpcomponents.core5/httpcore5/pom.properties | grep version
version=5.3.6

Ask

Please cut a patch release (3.7.2 or later) with the shaded httpcore5/httpcore5-h2 upgraded to ≥ 5.4.3.