[bric3]

What Does This Do

Warning

This draft has a confirmed AIA bypass and is incomplete. When Java fetches an omitted intermediate through AIA, the verifier cannot see that certificate and the request can still be sent. See the review finding.

Reject the eight compromised eMudhra public keys when they appear in the peer-supplied certificate chain, before sending HTTP headers or bodies. Retain OkHttp's hostname checks.

Apply the verifier at all three places that create an agent-owned OkHttp client:

• The shared HTTP client factory, including agentless CI Visibility traffic.
• LLM Observability's separate client.
• The Lambda extension client, including HTTPS URLs and redirects.

The four production client clones retain the verifier through newBuilder().

Caution

It doesn't remove the need to update to he latest JVM, or update the running JVM's keystore, as other usage within the JVM are not handled.

Motivation

CVE: CVE-2026-111943.

The eMudhra certificate compromise allows attackers to impersonate HTTPS servers while affected certificates remain trusted by the host JVM. Matching public keys also covers cross-signed certificates present in the peer-supplied chain.

Additional Notes

This follows Jesse Wilson's corrected mitigation, using a HostnameVerifier. His original interceptor checked certificates after the request had already been sent.

A local reproduction confirmed that the AIA bypass transmits the test header and body. A separate prototype blocked it with per-socket TLS algorithm constraints, but requires custom TLS setup beyond the intended quick patch. That prototype is not included in this draft.

The current draft also fails :communication:forbiddenApisMain because it directly references OkHttp's internal OkHostnameVerifier.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

[bric3]

@codex review

[bric3]

@DataDog review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T09:09:01.065866Z	12e12f0	Manual request
🔒 Security Review	✅ Completed 2026-10-21T09:11:19.350011Z	12e12f0	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 12e12f0dbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 12e12f0dbb

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[datadog-datadog-prod-us1-2]

The forbidden-certificate check in ForbiddenCertificatesHostnameVerifier only inspects the server-supplied chain via SSLSession.getPeerCertificates(), which omits AIA-fetched intermediates; on JVMs with -Dcom.sun.security.enableAIAcaIssuers=true, an attacker can bypass the check by omitting a compromised intermediate and letting JSSE fetch it silently. Fixing this requires validating the full, post-handshake certificate path rather than just the transmitted chain.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 12e12f0}

[datadog-datadog-prod-us1-2]

Check the validated certificate path for forbidden keys

With -Dcom.sun.security.enableAIAcaIssuers=true, an attacker can present a hostname-matching leaf signed by a compromised intermediate and serve that omitted intermediate through the leaf's AIA URI. SunJSSE can fetch the issuer to validate the connection, but SSLSession.getPeerCertificates() retains only the server-supplied chain. This loop therefore checks only the fresh leaf key and permits sensitive headers and bodies to reach the attacker. Check the validated certificate path, including fetched issuers, before transmission and cover an omitted-intermediate handshake; this requires broader changes than a local replacement.

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means

• 👍 Useful: correct, and you're fixing it or will.
• 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
• 😕 Unclear: you can't tell what it means or why it matters.
• 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

_{🤖 Bits Code Review · Open Bits AI session}

[bric3]

note: Confirmed with a local omitted-intermediate regression on Java 8 and 25. SunJSSE validates leaf -> AIA-fetched intermediate -> trusted root, while SSLSession.getPeerCertificates() contains only the leaf. This verifier hashes the fresh leaf key and accepts it. The test API-key header and body then reach the server.

AIA issuer retrieval must be enabled. On the tested Java 25 runtime, com.sun.security.allowedAIALocations must also permit the issuer URI. AIA retrieval is disabled by default (Oracle documentation).

A prototype added SPKI-based AlgorithmConstraints to each SSLSocket through SSLParameters before the handshake, retaining the default trust manager. SunJSSE then rejected the fetched issuer during PKIX path validation, before HTTP data was sent. The regression passed on both JVMs. This requires an SSLSocketFactory wrapper and explicit TLS setup, so I kept that broader change out of this quick patch and documented the remaining bypass in the PR description.

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.94 s	13.94 s	[-0.8%; +0.8%] (no difference)
startup:insecure-bank:tracing:Agent	12.83 s	13.01 s	[-2.1%; -0.6%] (maybe better)
startup:petclinic:appsec:Agent	17.01 s	16.97 s	[-0.7%; +1.1%] (no difference)
startup:petclinic:iast:Agent	16.25 s	16.87 s	[-7.8%; +0.4%] (no difference)
startup:petclinic:profiling:Agent	16.57 s	16.83 s	[-2.8%; -0.3%] (maybe better)
startup:petclinic:sca:Agent	16.97 s	16.79 s	[+0.1%; +2.0%] (maybe worse)
startup:petclinic:tracing:Agent	15.69 s	16.09 s	[-6.7%; +1.8%] (no difference)

Commit: 12e12f0d · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.