fix: spring-core tomcat netty version bump

Derek Zhangrequested to merge
cve-fix into main

Type of change

  • Bug Fix
  • Feature

Please provide link to gitlab issue or ADR(Architecture Decision Record) in Title (using number of issue)

Does this introduce a change in the cloud provider implementation, if so which cloud?

  • Core
  • AWS
  • Azure
  • GCP
  • IBM

Does this introduce a breaking change?

  • Breaking change

What is the current behavior?

What is the new/expected behavior?

Have you added/updated Unit Tests and Integration Tests and documentation?

  • Unit tests
  • Integration tests
  • Documentation

Any other useful information

org.apache.tomcat.embed:tomcat-embed-core (app.jar) │ CVE-2025-48989

io.netty:netty-codec-http2 (app.jar) │ CVE-2025-55163 │ HIGH

org.springframework:spring-core │ CVE-2025-41249

Merge request reports