[BUG] SECURITY: hertzbeat uses bouncycastle jars that have multiple CVEs

[pjfanning]

Is there an existing issue for this?

• [x] I have searched the existing issues

Current Behavior

BouncyCastle no longer ship jdk15on jars. Projects should use the jdk18on ones instead. The jdk15on jars were for Java 1.5 users and fixes that have been made to the jdk18on jars (Java 1.8 compatible) have not been backported - including security fixes.

The last Hertzbeat RC had bcprov-jdk15on-1.69.jar

• https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on/1.69
• https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on (1.81 current latest)

The classe names and packages are the same.

Expected Behavior

No response

Steps To Reproduce

No response

Environment

HertzBeat version(s):

Debug logs

No response

Anything else?

No response

[tomsun28]

Got it thanks.

[gns34]

I would like to try this. Can assign to me please?

[MadhuriRathod30]

Hi @pjfanning , can you please assign this to me?

[pjfanning]

Hi @pjfanning , can you please assign this to me?

I don't have this access.

[MadhuriRathod30]

Hi @tomsun28 , can you please assign this to me ?

[tomsun28]

hi @MadhuriRathod30 welcome, this has assigned to you.

hi @gns34 sorry for that. Lady first. If you have any other task want to try, please @ me.

[gns34]

Sure, No Problem

[MadhuriRathod30]

Hi @tomsun28 thank you.

[MadhuriRathod30]

Hi @tomsun28 ,

I did some research and found out that Bouncy castle is not a direct dependency but a transitive dependency used by com.vesoft:client. So now to fix the bug it is required that we exclude the transitive Bouncy Castle 1.69 version and explicitly add the latest stable release, which is currently 1.81 (as of July 2025).

However, this change introduces some maintenance overhead, as we now need to manually manage the version compatibility with any updates in com.vesoft:client. Please let me know if you're okay with proceeding with this approach.

For your reference adding the link for current Bouncy Castle version used by Vespa Client: Maven Central: https://central.sonatype.com/artifact/com.vesoft/client

Let me know your thoughts on this. I'm happy to proceed with the change if we agree on the direction.

[tomsun28]

hi @MadhuriRathod30 👍 I find the com.vesoft:client is introduced by hertzbeat-collector/hertzbeat-collector-nebulagraph pom. I think your solution is good, but we need to pay attention to the availability of the code after upgrading or removing bcprov. cc @zhangshenghang

[pjfanning]

I created https://github.com/vesoft-inc/nebula-java/pull/618 but there is no guarantee

• that vesoft will accept it
• do a release any time soon

While I would prefer if Hertzbeat made the change suggested by @MadhuriRathod30, since the Bouncy Castle dependency is transitive, it may be ok to stick with the dependency as is.

It's a pity that vesoft don't maintain their dependencies. There are other CVEs associated with their okhttp dependency etc. They have also gone and chosen dependencies to maximise inconvenience to their users.