)]}'
{
  "commit": "8c783edfdbcd5490a0eb2bedbc3c6a797239b767",
  "tree": "2bc3321e9931c969a993d7d258bb175702d1118e",
  "parents": [
    "173bad188265168bd8ac898aa68f4bbb3d16b7d1",
    "cfbaf6a6484f634d4937477f2e1391c57f733635"
  ],
  "author": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Tue Aug 04 08:27:21 2026 -1000"
  },
  "committer": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Tue Aug 04 08:27:21 2026 -1000"
  },
  "message": "Harden five anonymous-reachable surfaces from a private security report\n\nReported privately via security@apache.org on 2026-07-30 against\n54de37f455. All five reproduce; four are fixed here, one (F3) is\nhardened with an opt-in rather than treated as a vulnerability.\n\nF1 CWE-918  WS-Addressing ReplyTo/FaultTo drive a server-initiated connection\n            to a caller-chosen address. Screened in AddressingInHandler, at the\n            inbound trust boundary, rather than in the transport sender, which\n            also carries legitimate client calls. Link-local, wildcard and\n            multicast refused always; loopback and private ranges behind\n            blockPrivateNetworkResponseEndpoints.\nF2 CWE-79   The Host reached an inline script unescaped in the Swagger UI page.\n            URI.create did not neutralise it. Host validated, output encoded for\n            the script context, inline block nonced under a CSP.\nF3 CWE-644  servers[].url followed the request Host. Added openapi.serverBaseUrl\n            to pin it; the request-derived default still follows the Host, as it\n            does in comparable OpenAPI implementations.\nF4 CWE-770  The multipart and form-urlencoded builders read the transport stream\n            directly, so the container\u0027s post limit never applied. Both bounded,\n            configurable per service. Multipart temp files are now deleted\n            rather than accumulating.\nF5 CWE-862  The .xsd/.wsdl file routes, HTTPWorker\u0027s named-WSDL route and the\n            whole OpenAPI/MCP generator ignored exposeServiceMetadata.\n\nCVEs to be requested after release, per the process followed for\nCVE-2026-66713.\n",
  "tree_diff": []
}