# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI](https://agentprime.io/advisories/GHSA-9pwp-9qqc-pr26.md)
  `GHSA-9pwp-9qqc-pr26`, `CVE-2026-8763` · Maven `org.bouncycastle:bc-fips` and 3 more: affected `<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3`, fixed in `1.0.2.7`, `2.0.2`, `2.1.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [core-geonetwork has an Open Redirect Bypass](https://agentprime.io/advisories/GHSA-pjp7-q6wp-97qx.md)
  `GHSA-pjp7-q6wp-97qx`, `CVE-2026-53573` · Maven `org.geonetwork-opensource:geonetwork`: affected `>=3.12.0, <=3.12.12 || >=4.0.0-alpha.1, <=4.0.6 || >=4.2.0, <4.2.16 || >=4.4.0, <4.4.11`, fixed in `4.2.16`, `4.4.11` · CVSS 4.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Open redirect
- [Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)](https://agentprime.io/advisories/GHSA-93wv-jw9v-4972.md)
  `GHSA-93wv-jw9v-4972`, `CVE-2026-56819` · Maven `io.netty:netty-codec-http2`: affected `>=4.2.0, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service
- [Spring Data: Unbounded property-path cache keyed by externally-supplied path string](https://agentprime.io/advisories/GHSA-88fw-v6x4-3f58.md)
  `GHSA-88fw-v6x4-3f58`, `CVE-2026-41695` · Maven `org.springframework.data:spring-data-commons`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.13`, fixed in `4.0.6`, `3.5.12` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service
- [Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS](https://agentprime.io/advisories/GHSA-hjcp-jmpx-g3qm.md)
  `GHSA-hjcp-jmpx-g3qm`, `CVE-2026-64607` · Maven `org.apache.httpcomponents.client5:httpclient5`: affected `>=5.0-alpha1, <5.6.3`, fixed in `5.6.3` · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service
- [OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords](https://agentprime.io/advisories/GHSA-rwqx-fvqh-6wm4.md)
  `GHSA-rwqx-fvqh-6wm4`, `CVE-2026-54704` · Maven `io.opentelemetry.javaagent:opentelemetry-javaagent`: affected `<2.28.0-alpha`, fixed in `2.28.0-alpha` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Information disclosure
- [OpenTelemetry Javaagent RMI context propagation allows resource exhaustion](https://agentprime.io/advisories/GHSA-fq3f-m5qm-99f5.md)
  `GHSA-fq3f-m5qm-99f5`, `CVE-2026-54712` · Maven `io.opentelemetry.javaagent:opentelemetry-javaagent`: affected `<2.27.0`, fixed in `2.27.0` · CVSS 5.3 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Denial of service
- [Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities](https://agentprime.io/advisories/GHSA-qcxp-gm7m-4j5v.md)
  `GHSA-qcxp-gm7m-4j5v`, `CVE-2026-50559` · Maven `io.quarkus:quarkus-vertx-http`: affected `<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0`, fixed in `3.20.6.2`, `3.27.4.1`, `3.33.2.1`, `3.36.3`, `3.37.0` · CVSS 7.5 High · Not analysed yet · Published 29 Jul 2026 · Tags: Authentication bypass, Broken access control, CWE-41, CWE-178
- [veraPDF Parser DoS via PostScript Type 1 Font Programs](https://agentprime.io/advisories/GHSA-7c26-995w-6f47.md)
  `GHSA-7c26-995w-6f47`, `CVE-2026-54081` · Maven `org.verapdf:parser`: affected `<1.30.2 || >=1.31.1, <1.31.23`, fixed in `1.30.2`, `1.31.23` · CVSS 6.9 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-1325
- [veraPDF Parser DoS via PostScript CMap Streams](https://agentprime.io/advisories/GHSA-jrmc-qg6p-94fp.md)
  `GHSA-jrmc-qg6p-94fp`, `CVE-2026-54080` · Maven `org.verapdf:parser`: affected `<1.30.2 || >=1.31.1, <1.31.23`, fixed in `1.30.2`, `1.31.23` · CVSS 6.9 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-1325
- [veraPDF-validatio: Use of Default \`DocumentBuilderFactory\` leads to XXE When Processing Untrusted PDFs](https://agentprime.io/advisories/GHSA-cg9x-g3gm-h5h6.md)
  `GHSA-cg9x-g3gm-h5h6`, `CVE-2026-54082` · Maven `org.verapdf:validation-model` and 1 more: affected `>=1.17.35, <1.30.2 || >=1.31.1, <1.31.71`, fixed in `1.30.2`, `1.31.71` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: XML external entities (XXE)
- [veraPDF Validation XXE via Rich Text](https://agentprime.io/advisories/GHSA-3jh7-wm29-q568.md)
  `GHSA-3jh7-wm29-q568`, `CVE-2026-54078` · Maven `org.verapdf:validation-model` and 1 more: affected `>=1.25.73, <1.30.2 || >=1.31.1, <1.31.71`, fixed in `1.30.2`, `1.31.71` · CVSS 8.7 High · Not analysed yet · Published 29 Jul 2026 · Tags: XML external entities (XXE)
- [veraPDF Validation XXE via XFA](https://agentprime.io/advisories/GHSA-36mm-w85j-3q2j.md)
  `GHSA-36mm-w85j-3q2j`, `CVE-2026-54079` · Maven `org.verapdf:validation-model` and 1 more: affected `>=1.17.35, <1.30.2 || >=1.31.1, <1.31.71`, fixed in `1.30.2`, `1.31.71` · CVSS 8.7 High · Not analysed yet · Published 29 Jul 2026 · Tags: XML external entities (XXE)
- [QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding](https://agentprime.io/advisories/GHSA-85rg-p3fr-xc2f.md)
  `GHSA-85rg-p3fr-xc2f`, `CVE-2026-54609`, `PYSEC-2026-3615` · Maven `com.quietterminal:qti-neon` and 2 more: affected `=1.0.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service, CWE-406
- [Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities](https://agentprime.io/advisories/GHSA-4r9r-4425-74p7.md)
  `GHSA-4r9r-4425-74p7`, `CVE-2026-55771` · Maven `com.cedarpolicy:cedar-java`: affected `<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0`, fixed in `2.3.6`, `3.4.1`, `4.9.0` · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection, Memory corruption, CWE-697
- [java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor](https://agentprime.io/advisories/GHSA-28f5-38xr-jh2w.md)
  `GHSA-28f5-38xr-jh2w`, `CVE-2026-43910` · Maven `io.appium:java-client`: affected `>=8.2.1, <10.1.1`, fixed in `10.1.1` · CVSS 8.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages](https://agentprime.io/advisories/GHSA-4j38-rw27-97gx.md)
  `GHSA-4j38-rw27-97gx`, `CVE-2023-37465` · Maven `org.xwiki.contrib:discussions-server`: affected `<2.0-rc-1`, fixed in `2.0-rc-1` · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop](https://agentprime.io/advisories/GHSA-8wv5-x4w7-5gww.md)
  `GHSA-8wv5-x4w7-5gww`, `BIT-thrift-2026-43871`, `CVE-2026-43871`, `PKSA-t5dt-c9kk-znks`, `PYSEC-2026-3926` · Go `github.com/apache/thrift` and 3 more: affected `<0.24.0`, fixed in `0.24.0` · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service
- [OmniFaces: Forged combined-resource IDs and related output/push boundaries](https://agentprime.io/advisories/GHSA-fp43-vj7g-pg92.md)
  `GHSA-fp43-vj7g-pg92`, `CVE-2026-102695` · Maven `org.omnifaces:omnifaces`: affected `<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2`, fixed in `1.14.3`, `2.7.33`, `3.14.23`, `4.7.12`, `5.4.2` · CVSS 8.2 High · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), Information disclosure, Denial of service, Broken access control
- [blaze: Unbounded WebSocket message aggregation in http4s-blaze-server](https://agentprime.io/advisories/GHSA-7ppr-r889-mcf2.md)
  `GHSA-7ppr-r889-mcf2`, `CVE-2026-73493` · Maven `org.http4s:http4s-blaze-server_2.12` and 2 more: affected `<0.23.18`, fixed in `0.23.18` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)](https://agentprime.io/advisories/GHSA-46q4-43ph-c6fr.md)
  `GHSA-46q4-43ph-c6fr`, `CVE-2026-73495` · Maven `org.http4s:blaze-http_2.12` and 2 more: affected `<0.23.18`, fixed in `0.23.18` · CVSS 7.4 High · Not analysed yet · Published 24 Jul 2026 · Tags: HTTP request smuggling
- [blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser](https://agentprime.io/advisories/GHSA-mhvj-jhpq-885v.md)
  `GHSA-mhvj-jhpq-885v`, `CVE-2026-73494` · Maven `org.http4s:blaze-http_2.13` and 2 more: affected `<0.23.18 || >=1.0.0-M1, <1.0.0-M42`, fixed in `0.23.18`, `1.0.0-M42` · CVSS 7.4 High · Not analysed yet · Published 24 Jul 2026 · Tags: HTTP request smuggling
- [OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check](https://agentprime.io/advisories/GHSA-p279-2cqp-84jg.md)
  `GHSA-p279-2cqp-84jg`, `CVE-2026-73644` · Maven `org.openidentityplatform.opendj:opendj-server-legacy`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control
- [OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway](https://agentprime.io/advisories/GHSA-68r5-9hpg-7qw9.md)
  `GHSA-68r5-9hpg-7qw9` · Maven `org.openidentityplatform.opendj:opendj-dsml-servlet`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Denial of service, Server-side request forgery (SSRF)
- [OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback](https://agentprime.io/advisories/GHSA-wg5r-wc3x-39vc.md)
  `GHSA-wg5r-wc3x-39vc`, `CVE-2026-62379` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.2`, fixed in `16.1.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection
- [OpenAM Reflected XSS in the OAuth2/OIDC \`wap\` consent page](https://agentprime.io/advisories/GHSA-vqxv-6xrh-49cp.md)
  `GHSA-vqxv-6xrh-49cp`, `CVE-2026-62280` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `>=13.0.0, <16.1.2`, fixed in `16.1.2` · CVSS 6.1 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS)
- [OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass](https://agentprime.io/advisories/GHSA-gf8h-gq53-288j.md)
  `GHSA-gf8h-gq53-288j`, `CVE-2026-62263` · Maven `org.openidentityplatform.openam:openam-auth-webauthn`: affected `<16.1.2`, fixed in `16.1.2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Insecure deserialization
- [Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion](https://agentprime.io/advisories/GHSA-v74w-7mr3-4qg3.md)
  `GHSA-v74w-7mr3-4qg3`, `CVE-2026-73507` · Maven `io.netty:netty-codec-xml`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names](https://agentprime.io/advisories/GHSA-mfg7-5gfp-c4w3.md)
  `GHSA-mfg7-5gfp-c4w3`, `CVE-2026-73508` · Maven `io.netty:netty-codec-dns`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service
- [AWS CDK CodeBuild S3 Log Encryption Boolean Inversion](https://agentprime.io/advisories/GHSA-464c-974j-9xm6.md)
  `GHSA-464c-974j-9xm6`, `GO-2026-6093` · Go `github.com/aws/aws-cdk-go/awscdk` and 9 more: affected `>=1.175.0-devpreview, <=1.204.0-devpreview`, no fixed version yet · CVSS 3.3 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Weak cryptography or TLS, CWE-682
- [LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges](https://agentprime.io/advisories/GHSA-xx22-p4ch-683r.md)
  `GHSA-xx22-p4ch-683r`, `CVE-2026-59949` · Maven `at.yawk.lz4:lz4-java` and 1 more: affected `<1.11.1`, fixed in `1.11.1` · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption
- [c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets](https://agentprime.io/advisories/GHSA-w6w4-rjh9-9r58.md)
  `GHSA-w6w4-rjh9-9r58`, `CVE-2026-55223` · Maven `com.mchange:c3p0`: affected `<0.14.0`, fixed in `0.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization, Broken access control
- [fastjson has a remote code execution (RCE) vulnerability](https://agentprime.io/advisories/GHSA-crf3-v9rr-v7hj.md)
  `GHSA-crf3-v9rr-v7hj`, `CVE-2026-16723` · Maven `com.alibaba:fastjson`: affected `>=1.2.68, <=1.2.83`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization, CWE-20
- [Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests](https://agentprime.io/advisories/GHSA-9299-c6m4-mjhc.md)
  `GHSA-9299-c6m4-mjhc`, `CVE-2024-7708` · Maven `org.eclipse.jetty:jetty-server`: affected `>=10.0.7, <10.0.23 || >=11.0.7, <11.0.23`, fixed in `10.0.23`, `11.0.23` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Eclipse Jetty: Path parameter traversal](https://agentprime.io/advisories/GHSA-w7x5-g22v-xqhr.md)
  `GHSA-w7x5-g22v-xqhr`, `CVE-2026-8384` · Maven `org.eclipse.jetty:jetty-util`: affected `>=12.0.0, <12.0.35 || >=12.1.0, <12.1.9`, fixed in `12.0.35`, `12.1.9` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-647
- [Eclipse Jetty: HTTP Authority/Host mismatch](https://agentprime.io/advisories/GHSA-7p3p-8qv8-m2vh.md)
  `GHSA-7p3p-8qv8-m2vh`, `CVE-2026-6790` · Maven `org.eclipse.jetty:jetty-server`: affected `>=9.4.0.v20161208, <=9.4.58.v20250814 || >=10.0.0, <=10.0.26 || >=11.0.0, <=11.0.26 || >=12.0.0, <12.0.35 || >=12.1.0, <12.1.9`, fixed in `12.0.35`, `12.1.9` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-20
- [Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections](https://agentprime.io/advisories/GHSA-f4v5-65jj-pcr2.md)
  `GHSA-f4v5-65jj-pcr2`, `CVE-2026-10051` · Maven `org.eclipse.jetty:jetty-server`: affected `>=12.0.0, <12.0.36 || >=12.1.0, <12.1.10`, fixed in `12.0.36`, `12.1.10` · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Information disclosure
- [Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution](https://agentprime.io/advisories/GHSA-2fvj-hgj9-j2gr.md)
  `GHSA-2fvj-hgj9-j2gr`, `CVE-2026-10050` · Maven `org.eclipse.jetty.ee8:jetty-ee8-security` and 2 more: affected `>=12.0.0, <12.0.36 || >=12.1.0, <12.1.10`, fixed in `12.0.36`, `12.1.10` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Authentication bypass, CWE-173
- [Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder](https://agentprime.io/advisories/GHSA-gcjf-9mgh-3p7g.md)
  `GHSA-gcjf-9mgh-3p7g`, `CVE-2026-59921` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 5.7 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Other injection
- [Netty: STOMP CONNECT Frame Header Injection in Netty](https://agentprime.io/advisories/GHSA-3g8r-4pfx-jmfh.md)
  `GHSA-3g8r-4pfx-jmfh`, `CVE-2026-59920` · Maven `io.netty:netty-codec-stomp`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Other injection
- [Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address](https://agentprime.io/advisories/GHSA-wh89-7897-x99h.md)
  `GHSA-wh89-7897-x99h`, `CVE-2026-59919` · Maven `io.netty:netty-codec-haproxy`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 5.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Other injection
- [Netty: \[Bzip2Decoder\] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang](https://agentprime.io/advisories/GHSA-558v-64gr-wgg4.md)
  `GHSA-558v-64gr-wgg4`, `CVE-2026-59901` · Maven `io.netty:netty-codec` and 1 more: affected `<4.1.136.Final`, fixed in `4.1.136.Final` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Netty: \[codec-http2\] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass](https://agentprime.io/advisories/GHSA-c69g-56f8-xwqj.md)
  `GHSA-c69g-56f8-xwqj`, `CVE-2026-59900` · Maven `io.netty:netty-codec-http2`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: HTTP request smuggling
- [Netty: \[HttpContentEncoder\] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service](https://agentprime.io/advisories/GHSA-q4f6-jm68-57ww.md)
  `GHSA-q4f6-jm68-57ww`, `CVE-2026-59899` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation](https://agentprime.io/advisories/GHSA-4mp9-239f-g9hg.md)
  `GHSA-4mp9-239f-g9hg`, `CVE-2026-59898` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: HTTP request smuggling
- [Netty: TOCTOU in OcspServerCertificateValidator](https://agentprime.io/advisories/GHSA-wc96-39fc-566f.md)
  `GHSA-wc96-39fc-566f`, `CVE-2026-56822` · Maven `io.netty:netty-handler-ssl-ocsp`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.4 High · Not analysed yet · Published 22 Jul 2026 · Tags: Race condition
- [Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator](https://agentprime.io/advisories/GHSA-g7hg-vrcf-mvmr.md)
  `GHSA-g7hg-vrcf-mvmr`, `CVE-2026-56821` · Maven `io.netty:netty-handler-ssl-ocsp`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.4 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-299
- [Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks](https://agentprime.io/advisories/GHSA-272m-gcwp-mpwg.md)
  `GHSA-272m-gcwp-mpwg`, `CVE-2026-56820` · Maven `io.netty:netty-handler-ssl-ocsp`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.4 High · Not analysed yet · Published 22 Jul 2026 · Tags: Weak cryptography or TLS
- [Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling](https://agentprime.io/advisories/GHSA-4qhr-g3c6-fcfx.md)
  `GHSA-4qhr-g3c6-fcfx`, `CVE-2026-56817` · Maven `io.netty:netty-codec-xml`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 8.3 High · Not analysed yet · Published 22 Jul 2026 · Tags: XML external entities (XXE)
- [Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types](https://agentprime.io/advisories/GHSA-hpcc-26xq-25fv.md)
  `GHSA-hpcc-26xq-25fv`, `CVE-2026-56816` · Maven `io.netty:netty-codec-http3`: affected `<4.2.16.Final`, fixed in `4.2.16.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Netty: Security Control Bypass via CORS Short-Circuit Failure](https://agentprime.io/advisories/GHSA-6cqp-g7gg-8hr5.md)
  `GHSA-6cqp-g7gg-8hr5`, `CVE-2026-56746` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control
- [Netty: \[SpdyHttpDecoder\] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion](https://agentprime.io/advisories/GHSA-jppx-w49h-x2qq.md)
  `GHSA-jppx-w49h-x2qq`, `CVE-2026-56745` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Netty: \[codec-haproxy\] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion](https://agentprime.io/advisories/GHSA-q6cq-mhr2-jmr5.md)
  `GHSA-q6cq-mhr2-jmr5`, `CVE-2026-55851` · Maven `io.netty:netty-codec-haproxy`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation](https://agentprime.io/advisories/GHSA-mvh2-crg5-v77c.md)
  `GHSA-mvh2-crg5-v77c`, `CVE-2026-55833` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Netty SPDY SETTINGS frame count materializes unbounded settings map](https://agentprime.io/advisories/GHSA-6jqx-86gh-f27w.md)
  `GHSA-6jqx-86gh-f27w`, `CVE-2026-55831` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization](https://agentprime.io/advisories/GHSA-5gvw-p9qm-jgwh.md)
  `GHSA-5gvw-p9qm-jgwh`, `CVE-2026-59889` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.19.0, <2.21.5 || >=2.0.0-RC1, <2.18.9 || >=2.22.0, <2.22.1`, fixed in `2.21.5`, `2.18.9`, `2.22.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control
- [jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)](https://agentprime.io/advisories/GHSA-r7wm-3cxj-wff9.md)
  `GHSA-r7wm-3cxj-wff9`, `CVE-2026-68494` · Maven `com.fasterxml.jackson.core:jackson-core` and 1 more: affected `<2.18.8 || >=2.19.0, <2.21.4`, fixed in `2.18.8`, `2.21.4` · CVSS 8.7 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service
- [jackson-databind: \`@JsonView\` bypass for creator properties with \`@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)\`](https://agentprime.io/advisories/GHSA-mhm7-754m-9p8w.md)
  `GHSA-mhm7-754m-9p8w` · Maven `com.fasterxml.jackson.core:jackson-databind`: affected `>=2.18.0, <2.18.9 || >=2.21.0, <2.21.5`, fixed in `2.18.9`, `2.21.5` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control
- [jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy](https://agentprime.io/advisories/GHSA-3pjw-73gf-8qr5.md)
  `GHSA-3pjw-73gf-8qr5`, `CVE-2026-59888` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.15.0, <2.18.8 || >=2.19.0, <2.21.4`, fixed in `2.18.8`, `2.21.4` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control
- [Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration](https://agentprime.io/advisories/GHSA-f3j8-8ggq-f9x2.md)
  `GHSA-f3j8-8ggq-f9x2` · Maven `org.eclipse.hawkbit:hawkbit-ddi-resource`: affected `<1.0.4`, fixed in `1.0.4` · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTA3LTIxVDE4OjMxOjAyLjAwMDAwMFoiLCJHSFNBLWYzajgtOGdncS1mOXgyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA4LTAzVDA2OjMxOjQ0LjAwMDAwMFoiLCJHSFNBLXFwNDktcWd4NS01bTI2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA4LTAzVDA2OjMxOjQ0LjAwMDAwMFoiLCJHSFNBLXFwNDktcWd4NS01bTI2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.