Maven Advisories.

Keycloak has authentication bypass via jwt algorithm confusion

• Weak cryptography or TLS

<26.6.4 · fixed in 26.6.4

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

• Denial of service
• CWE-130

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

• Memory corruption
• CWE-130

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.10 · fixed in 3.3.7, 3.4.5, 3.5.10

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

• Denial of service
• CWE-20

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

• Path traversal
• CWE-20

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

• CWE-838

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

• Server-side request forgery (SSRF)

<8.51.0 · fixed in 8.51.0

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

• Cross-site scripting (XSS)

<26.6.4 · fixed in 26.6.4

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

• Path traversal

<26.6.4 · fixed in 26.6.4

Keycloak allows unauthorized access to resources via uma permission ticket bypass

• Broken access control

<26.6.4 · fixed in 26.6.4

Keycloak vulnerable to authorization bypass via incorrect uri comparison

• CWE-1025

<26.0.10 · fixed in 26.0.10

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

• Authentication bypass

<26.6.4 · fixed in 26.6.4

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

• Denial of service

<1.67.0 · fixed in 1.67.0

snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

• Memory corruption
• CWE-193

<1.1.10.9 · fixed in 1.1.10.9

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

• Memory corruption
• CWE-129

<1.1.10.9 · fixed in 1.1.10.9

snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

• Denial of service

<1.1.10.9 · fixed in 1.1.10.9

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

• Denial of service
• Insecure deserialization

>=4.0, <33.7.2 · fixed in 33.7.2

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

• CWE-693

<3.4.13 · fixed in 3.4.13

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

• Information disclosure

<1.3.0.Final · fixed in 1.3.0.Final

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

• Hard-coded credentials

>=1.3.0.Final, <1.3.2.Final · fixed in 1.3.2.Final

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

• Server-side request forgery (SSRF)

<1.3.0.Final · fixed in 1.3.0.Final

A2A Java SDK has a fail-open default task authorization

• Broken access control
• CWE-1188

<1.3.0.Final · fixed in 1.3.0.Final

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

• Hard-coded credentials

<1.3.0.Final · fixed in 1.3.0.Final

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

• Memory corruption

<1.5.14 · fixed in 1.5.14

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

• Denial of service

<7.6.1 · fixed in 7.6.1

Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

• Denial of service

* · no fixed version yet

Hazelcast allows arbitrary member memory access by low-privileged client

• CWE-20

>=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0 · fixed in 5.7.0

Hazelcast has an authorization bypass in IMap Predicates API

• Broken access control

>=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0 · fixed in 5.7.0

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

• Authentication bypass

>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1 · fixed in 3.0.14

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

• Authentication bypass
• CWE-693

>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1 · fixed in 3.0.14

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

• Denial of service
• CWE-409

>=3.0.0, <3.0.14 || >=2.2.0, <=2.16.1 · fixed in 3.0.14

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

• Broken access control
• CWE-346

>=3.0.0, <3.0.14 || >=2.0.0, <=2.16.1 · fixed in 3.0.14

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

• Weak cryptography or TLS

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

• CWE-1275

>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0.Beta1, <3.0.13 || >=2.0.0, <2.16.1 · fixed in 3.0.13, 2.16.1

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

• Denial of service

<5.36.1 · fixed in 5.36.1

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

• Race condition
• CWE-377

<1.11.4 · fixed in 1.11.4

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

• Denial of service

<1.11.4 · fixed in 1.11.4

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

• Denial of service

<1.11.4 · fixed in 1.11.4

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

• CWE-172
• CWE-248

<5.36.0 · fixed in 5.36.0

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

• Information disclosure

<5.35.0 · fixed in 5.35.0

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

• Denial of service

<1.11.2 · fixed in 1.11.2

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

• Denial of service

<1.11.2 · fixed in 1.11.2

Snowflake drivers writes sensitive information to logs

• Information disclosure

<=1.19.1 · no fixed version yet

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

• CWE-346
• CWE-441

>=6.0.0, <6.2.2 || >=7.0.0, <7.6.9 || >=8.5.0, <8.5.1 || >=8.3.5, <8.4.3 || >=8.0.0, <=8.3.4 · fixed in 6.2.2, 7.6.9, 8.5.1, 8.4.3

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

• XML external entities (XXE)

<0.1.2 · fixed in 0.1.2

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

• Denial of service

>=2.19.0, <2.21.7 || >=2.22.0, <2.22.3 || >=2.8.0, <2.18.11 · fixed in 2.21.7, 2.22.3, 2.18.11

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

• Denial of service

>=2.17.0, <2.18.11 || >=2.19.0, <2.21.7 || >=2.22.0, <2.22.3 · fixed in 2.18.11, 2.21.7, 2.22.3

jackson-databind quadratic forward-reference completion

• Denial of service

>=2.19.0, <2.21.7 || >=2.5.0, <2.18.11 || >=2.22.0, <2.22.3 · fixed in 2.21.7, 2.18.11, 2.22.3

jackson-databind retains every unknown raw type ID

• Denial of service

>=2.0.0, <2.18.11 || >=2.19.0, <2.21.7 || >=2.22.0, <2.22.3 · fixed in 2.18.11, 2.21.7, 2.22.3

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

• Insecure deserialization
• Broken access control

>=2.11.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2 · fixed in 2.18.10, 2.21.6, 2.22.2

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

• Denial of service

>=2.14.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2 · fixed in 2.18.10, 2.21.6, 2.22.2

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

• Code injection
• CWE-610

>=2.8.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2 · fixed in 2.18.10, 2.21.6, 2.22.2

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

• Server-side request forgery (SSRF)

>=2.0.0, <2.18.9 || >=2.19.0, <2.21.5 || >=2.22.0, <2.22.1 · fixed in 2.18.9, 2.21.5, 2.22.1

http4s-scala-xml has an XML External Entity (XXE) processing issue

• XML external entities (XXE)

<0.24.1 · fixed in 0.24.1

Jawn: Quadratic parsing effort in AsyncParser

• Denial of service

<1.7.0 · fixed in 1.7.0

Jawn: Uncontrolled nesting depth in JSON parser

• Denial of service

<1.7.0 · fixed in 1.7.0

JLine: ReDoS in Nano Editor Regex Search Mode

• Denial of service

>=4.0.0, <4.3.1 || >=3.0.0, <3.30.15 · fixed in 4.3.1, 3.30.15