[GEODE-10623] Remediation of CVE-2026-64607

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -181,7 +181,7 @@ class DependencyConstraints {
         api(group: 'org.apache.commons', name: 'commons-text', version: 1.9)
         api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0')
         // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support
-        api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4')
+        api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.6.4')
         api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.4.3')
         api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.4.3')
         // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete)

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -960,7 +960,7 @@ lib/geode-unsafe-0.0.0.jar
 lib/geode-wan-0.0.0.jar
 lib/gfsh-dependencies.jar
 lib/hibernate-validator-8.0.2.Final.jar
-lib/httpclient5-5.4.4.jar
+lib/httpclient5-5.6.4.jar
 lib/httpcore5-5.4.3.jar
 lib/httpcore5-h2-5.4.3.jar
 lib/istack-commons-runtime-4.1.1.jar

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -59,7 +59,7 @@ lucene-analysis-common-9.12.3.jar
 lucene-queryparser-9.12.3.jar
 lucene-queries-9.12.3.jar
 lucene-core-9.12.3.jar
-httpclient5-5.4.4.jar
+httpclient5-5.6.4.jar
 httpcore5-h2-5.4.3.jar
 httpcore5-5.4.3.jar
 HikariCP-4.0.3.jar

geode-management/src/main/java/org/apache/geode/management/api/RestTemplateClusterManagementServiceTransport.java

@@ -25,12 +25,14 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 
+import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
 
 import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
 import org.apache.hc.client5.http.io.HttpClientConnectionManager;
 import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
+import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.HttpHeaders;
@@ -164,7 +166,7 @@ public void configureConnection(ConnectionConfig connectionConfig) {
     // Configure SSL context and hostname verifier (HttpClient 5.x approach)
     // Only configure SSL if we have a non-null SSL context
     if (connectionConfig.getSslContext() != null) {
-      DefaultClientTlsStrategy sslSocketFactory = new DefaultClientTlsStrategy(
+      DefaultClientTlsStrategy sslSocketFactory = createTlsStrategy(
           connectionConfig.getSslContext(),
           connectionConfig.getHostnameVerifier());
 
@@ -178,7 +180,7 @@ public void configureConnection(ConnectionConfig connectionConfig) {
       // If only hostname verifier is set without SSL context, we need to use the default SSL
       // context
       try {
-        DefaultClientTlsStrategy sslSocketFactory = new DefaultClientTlsStrategy(
+        DefaultClientTlsStrategy sslSocketFactory = createTlsStrategy(
             SSLContext.getDefault(),
             connectionConfig.getHostnameVerifier());
 
@@ -197,6 +199,25 @@ public void configureConnection(ConnectionConfig connectionConfig) {
     restTemplate.setRequestFactory(requestFactory);
   }
 
+  /**
+   * Builds the TLS strategy used for HTTPS connections.
+   *
+   * <p>
+   * When the caller supplies a {@link HostnameVerifier}, that verifier alone decides whether the
+   * peer's certificate matches the endpoint, so the strategy is created with
+   * {@link HostnameVerificationPolicy#CLIENT}. Without an explicit verifier the strategy keeps the
+   * library's own endpoint identification.
+   * </p>
+   */
+  private static DefaultClientTlsStrategy createTlsStrategy(SSLContext sslContext,
+      HostnameVerifier hostnameVerifier) {
+    if (hostnameVerifier == null) {
+      return new DefaultClientTlsStrategy(sslContext);
+    }
+    return new DefaultClientTlsStrategy(sslContext, HostnameVerificationPolicy.CLIENT,
+        hostnameVerifier);
+  }
+
   @Override
   public <T extends AbstractConfiguration<?>> ClusterManagementRealizationResult submitMessage(
       T configMessage, CommandType command) {

geode-server-all/src/integrationTest/resources/dependency_classpath.txt

@@ -25,7 +25,7 @@ jackson-dataformat-yaml-2.21.6.jar
 jackson-core-2.21.6.jar
 jackson-datatype-joda-2.21.6.jar
 jackson-databind-2.21.6.jar
-httpclient5-5.4.4.jar
+httpclient5-5.6.4.jar
 httpcore5-h2-5.4.3.jar
 httpcore5-5.4.3.jar
 HikariCP-4.0.3.jar