[GHSA-7p8c-crfr-q93p] hutool Buffer Overflow vulnerability

[achibear]

Updates

• Affected products

Comments
According to https://mvnrepository.com/artifact/cn.hutool/hutool-core?p=10, its maven version starts at 4.0.6

[helixplant]

Hi @achibear,
Regarding the version range specifications, I wanted to clarify that when defining product dependencies with less-than range constraints, it's typically not necessary to explicitly include the exact lower bound that is available for download. While the MVN Repository package indicates version 4.0.6 as the lowest available version in the range, including this lower bound can be redundant since it's understood to be the starting point for the package on MVN Repository. Thank you for your interest in improving this advisory!