# Receiving security vulnerability in JAVA SDK 1.23.1

**URL:** <https://community.temporal.io/t/receiving-security-vulnerability-in-java-sdk-1-23-1/13630>\
**Category:** Community Support\
**Tags:** java-sdk\
**Created:** [September 22, 2024, 2:58pm UTC](https://community.temporal.io/t/receiving-security-vulnerability-in-java-sdk-1-23-1/13630 "2024-09-22T14:58:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abhinav\_Verma](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/abhinav_verma/32/4887_2.png) [@Abhinav\_Verma](https://community.temporal.io/u/Abhinav_Verma)\
**Post date:** [September 22, 2024, 2:58pm UTC](https://community.temporal.io/t/receiving-security-vulnerability-in-java-sdk-1-23-1/13630/1 "2024-09-22T14:58:16Z")

</div>

We are receiving snyk vulnerabilities from JAVA SDK 1.23.1. Following are the listed vulnerability

1. Protobuf-java-util ( 3.22.0 )
2. Protobuf-java ( 3.21.7 )  
So currently we are receiving vulnerability from above dependencies. Snyk is suggesting to use version greater than 3.25.5 but excluding from temporal-sdk and using it explicitly is not working. How to overcome above issue ?

---

<div class="post-metadata">

**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\
**Post date:** [October 13, 2024, 9:33am UTC](https://community.temporal.io/t/receiving-security-vulnerability-in-java-sdk-1-23-1/13630/2 "2024-10-13T09:33:03Z")

</div>

Could you link associated CVEs for these vulnerabilities?

> excluding from temporal-sdk and using it explicitly is not working

this should be possible, can you show your pom/gradle config and how you tried to exclude depends?