Address CVE-2026-40542

[karavanis]

As you can see on https://mvnrepository.com/artifact/com.refinitiv.eta/eta/3.10.0.1 com.refinitiv.eta / eta has CVE-2026-40542.

Updating org.apache.httpcomponents.client5 / httpclient5 from 5.6 to 5.6.1 should fix the problem

[MitchellKato]

Thank you for reporting this issue. We have investigated the impact, and ETA does not currently use this functionality, so it is not affected by this bug.

We will update httpclient5 in our next release.

[karavanis]

@MitchellKato the problem is that you bring the dependency with ETA meaning that you may not be impacted but other dependencies on the project that may unintentionally move to 5.6 be impacted.

[MitchellKato]

Applications using ETA can overwrite the dependency in Gradle using the strict keyword when declaring the dependency in their application:

https://docs.gradle.org/current/userguide/dependency_versions.html#sec:strict-version

[andysCaplin]

Thank you for reporting this issue. We have investigated the impact, and ETA does not currently use this functionality, so it is not affected by this bug.

We will update httpclient5 in our next release.

Note that httpclient5 5.6.1 still pins HttpCore 5.4 (both 5.6 and 5.6.1 do), so moving to 5.6.1 will not clear CVE-2026-54399 or CVE-2026-54428 in httpcore5/httpcore5-h2. Those need HttpCore 5.4.3.

[vlevendel]

This is addressed with tag Real-Time-SDK-2.4.0.G1