Hi,

The following vulnerability was published for gradle.

CVE-2026-22865[0]:
| Gradle is a build automation tool, and its native-platform tool
| provides Java bindings for native APIs. When resolving dependencies
| in versions before 9.3.0, some exceptions were not treated as fatal
| errors and would not cause a repository to be disabled. If a build
| encountered one of these exceptions, Gradle would continue to the
| next repository in the list and potentially resolve dependencies
| from a different repository. An exception like
| NoHttpResponseException can indicate transient errors. If the errors
| persist after a maximum number of retries, Gradle would continue to
| the next repository. This behavior could allow an attacker to
| disrupt the service of a repository and leverage another repository
| to serve malicious artifacts. This attack requires the attacker to
| have control over a repository after the disrupted repository.
| Gradle has introduced a change in behavior in Gradle 9.3.0 to stop
| searching other repositories when encountering these errors.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-22865
https://www.cve.org/CVERecord?id=CVE-2026-22865
[1] https://github.com/gradle/gradle/security/advisories/GHSA-mqwm-5m85-gmcv

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore