Our OWASP scan is showing that both com.google.cloud:libraries-bom:26.69.0 which lists com.google.cloud:google-cloud-storage:2.53.0 depend on io.grpc:grpc-netty-shaded:1.71.0. I checked if using com.google.cloud:google-cloud-storage:2.58.1 would resolve it, but that uses the same version of grpc-netty-shaded. This version of grpc-netty-shaded has an open vulnerability, CVE-2025-55163 which is reported fixed in 1.75.0.
Few questions...
Are these libraries impacted by this vulnerability from the transitive dependency?
If so, is there a timeline for a fix?
If so, from my end, could constraining the grpc-netty-shaded to version 1.75.0+ cause functional issues for ?
Thank you!
If it's helpful for answering the question regarding constraining the version, I am using google-cloud-storage for file upload/download and metdata management, including com.google.cloud.storage and com.google.cloud.storage.transfermanager packages.
Our OWASP scan is showing that both com.google.cloud:libraries-bom:26.69.0 which lists com.google.cloud:google-cloud-storage:2.53.0 depend on io.grpc:grpc-netty-shaded:1.71.0. I checked if using com.google.cloud:google-cloud-storage:2.58.1 would resolve it, but that uses the same version of grpc-netty-shaded. This version of grpc-netty-shaded has an open vulnerability, CVE-2025-55163 which is reported fixed in 1.75.0.
Few questions...
Are these libraries impacted by this vulnerability from the transitive dependency?
If so, is there a timeline for a fix?
If so, from my end, could constraining the grpc-netty-shaded to version 1.75.0+ cause functional issues for ?
Thank you!
If it's helpful for answering the question regarding constraining the version, I am using google-cloud-storage for file upload/download and metdata management, including com.google.cloud.storage and com.google.cloud.storage.transfermanager packages.