Vulnerability in org.glassfish.jersey.connectors:jersey-apache-connector:jar:2.27

[sumitkdey]

The apache connector org.glassfish.jersey.connectors:jersey-apache-connector:jar:2.27 has a dependency on org.apache.httpcomponents:httpclient:jar:4.5 which is known to be vulnerable as per https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Is there a newer version of the apache connector available that has this vulnerability resolved? If not, can you please create a new release?

[jansupol]

Thanks for pointing to this. However, you can update the httpclient in your pom (exclude the dependency on 4.5 and add a dependency to 4.5.3), should you really need it. We will update it in a next release, too.