CHK-13429: Pin Netty codec compression to 4.2.13.Final

build.gradle

@@ -22,6 +22,26 @@ allprojects {
     }
 }
 
+def versionParts = { String version ->
+    version.replace('.Final', '').tokenize('.').collect { it as int }
+}
+
+def isVersionLowerThan = { String version, String minimumVersion ->
+    def currentParts = versionParts(version)
+    def minimumParts = versionParts(minimumVersion)
+    def partsCount = Math.max(currentParts.size(), minimumParts.size())
+
+    for (int index = 0; index < partsCount; index++) {
+        def current = index < currentParts.size() ? currentParts[index] : 0
+        def minimum = index < minimumParts.size() ? minimumParts[index] : 0
+        if (current != minimum) {
+            return current < minimum
+        }
+    }
+
+    false
+}
+
 subprojects {
     configurations.configureEach {
         resolutionStrategy.eachDependency {
@@ -30,6 +50,11 @@ subprojects {
                 useVersion('3.1.1')
                 because('GHSA-2m67-wjpj-xhg9: Jackson Core 3.0.0-3.1.0 maxDocumentLength bypass')
             }
+            if (requested.group == 'io.netty' && requested.name == 'netty-codec-compression'
+                    && requested.version != null && isVersionLowerThan(requested.version, '4.2.13.Final')) {
+                useVersion('4.2.13.Final')
+                because('GHSA-mj4r-2hfc-f8p6: Netty Codec Compression before 4.2.13.Final is vulnerable to resource exhaustion')
+            }
             if (requested.group == 'org.apache.tomcat.embed' && requested.name == 'tomcat-embed-core'
                     && requested.version != null && requested.version < '11.0.21') {
                 useVersion('11.0.21')

openapi-validation-core/build.gradle

@@ -10,6 +10,12 @@ dependencies {
         implementation(libs.commons.codec) {
             because 'Apache commons-codec before 1.13 is vulnerable to information exposure. See https://devhub.checkmarx.com/cve-details/Cxeb68d52e-5509/'
         }
+        implementation('io.netty:netty-codec-compression') {
+            version {
+                strictly '4.2.13.Final'
+            }
+            because 'GHSA-mj4r-2hfc-f8p6: Netty Codec Compression before 4.2.13.Final is vulnerable to resource exhaustion. See https://github.com/getyourguide/openapi-validation-java/security/dependabot/59'
+        }
         implementation('org.mozilla:rhino:1.9.0') {
             because 'CVE-2025-66453: Rhino before 1.9.0 has high CPU usage and potential DoS when passing specific numbers to toFixed() function. See https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x'
         }