Maven Advisories.

Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade

• Weak cryptography or TLS

>=2.6.3, <2.8.7 · fixed in 2.8.7

Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)

• Insecure deserialization

>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6 · fixed in 2.0.28, 2.1.11, 2.2.6

Apache camel-coap allows header injection that can lead to remote code execution

• Broken access control

>=4.14.0, <4.14.6 || >=4.18.0, <4.18.1 · fixed in 4.14.6, 4.18.1

Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1 · fixed in 4.14.6, 4.18.1

Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=4.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.7, 4.18.2, 4.20.0

Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

• Insecure deserialization
• CWE-1173

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1 · fixed in 4.14.6, 4.18.1

Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

• Authentication bypass
• CWE-551

>=4.14.1, <4.14.6 || >=4.18.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.6, 4.18.2, 4.20.0

Camel-MINA Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.6, 4.18.2, 4.20.0

Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

• Insecure deserialization

>=3.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.7, 4.18.2, 4.20.0

Apache Camel has an incomplete fix for CVE-2025-27636

• CWE-178

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.6, 4.18.2, 4.20.0

Apache MINA vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6 · fixed in 2.0.28, 2.1.11, 2.2.6

Camel-PQC Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.18.2, 4.20.0

Dynamic-Datasource has an Injection vulnerability

• Other injection
• CWE-707

<=4.5.0 · no fixed version yet

Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

• Denial of service

<2.18.1 · fixed in 2.18.1

Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection

• Code injection
• CWE-20

<5.19.6 || >=6.0.0, <6.2.5 · fixed in 5.19.6, 6.2.5

Apache ActiveMQ Vulnerable to Code Injection

• Code injection
• CWE-20

<5.19.6 || >=6.0.0, <6.2.5 · fixed in 5.19.6, 6.2.5

Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability

• Insecure deserialization

>=3.2.0, <3.3.1 · fixed in 3.3.1

Apache DolphinScheduler has an Incorrect Authorization Vulnerability

• Broken access control

<3.4.1 · fixed in 3.4.1

Apache ActiveMQ Vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)
• Broken access control

<5.19.6 || >=6.0.0, <6.2.5 · fixed in 5.19.6, 6.2.5

Apktool: Path Traversal to Arbitrary File Write

• Path traversal

>=3.0.0, <3.0.2 · fixed in 3.0.2

H2O-3 is Vulnerable to Code Injection

• Code injection

<3.46.0.10 · fixed in 3.46.0.10

Silverpeas Core has a reflected cross-site scripting vulnerability

• Cross-site scripting (XSS)

<=6.4-feature13197 · no fixed version yet

camel-infinispan Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<4.20.0 · fixed in 4.20.0

OpenRemote has Improper Access Control via updateUserRealmRoles function

• Broken access control

<1.22.1 · fixed in 1.22.1

Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

• Authentication bypass
• CWE-325

>=5.6-alpha1, <5.6.1 · fixed in 5.6.1

Spring Security has Potential Security Misconfiguration when Using withIssuerLocation

• CWE-20

>=6.3.0, <=6.3.14 || >=6.4.0, <=6.4.14 || >=6.5.0, <6.5.10 || >=7.0.0, <7.0.5 · fixed in 6.5.10, 7.0.5

Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers

• CWE-693

>=7.0.0, <7.0.5 · fixed in 7.0.5

Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

• Broken access control
• CWE-551

>=7.0.0, <7.0.5 · fixed in 7.0.5

Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

• CWE-208

>=5.7.0, <=5.7.22 || >=5.8.0, <=5.8.24 || >=6.3.0, <=6.3.15 || >=6.4.0, <=6.4.15 || >=6.5.0, <6.5.10 || >=7.0.0, <7.0.5 · fixed in 6.5.10, 7.0.5

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

• Weak cryptography or TLS

>=7.0.0, <7.0.5 · fixed in 7.0.5

Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

• Race condition

>=6.5.0, <6.5.10 || >=7.0.3, <7.0.5 || >=6.4.0, <=6.4.13 · fixed in 6.5.10, 7.0.5

Spinnaker: RCE via expression parsing due to unrestricted context handling

• Code injection

>=2026.0-0, <2026.0.1 || >=2025.4-0, <2025.4.2 || <2025.3.2 · fixed in 2026.0.1, 2025.4.2, 2025.3.2

Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

• CWE-20

<2026.0.1 · fixed in 2026.0.1

Apache Kafka exposes sensitive information in its DEBUG logs

• Information disclosure
• CWE-533

>=0.11.0, <3.9.2 || >=4.0.0, <4.0.1 · fixed in 3.9.2, 4.0.1

Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation

• Authentication bypass
• CWE-1285

>=4.1.0, <4.1.2 · fixed in 4.1.2

Bouncy Castle Has Covert Timing Channel Vulnerability

• CWE-385

>=1.71, <1.84 · fixed in 1.84

Bouncy Castle Uncontrolled Resource Consumption vulnerability

• Denial of service

<=130 · no fixed version yet

Bouncy Castle has an LDAP injection

• Other injection

>=1.74, <1.84 · fixed in 1.84

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

• Weak cryptography or TLS
• CWE-323

>=1.59, <=1.80.1 || >=1.82, <1.84 · fixed in 1.84

PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability

• Cross-site request forgery (CSRF)

<5.7.10 || >=6.0.0-RC1, <6.4.1 · fixed in 5.7.10, 6.4.1

OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

• Code injection

<1.14.2 || >=2.0-RC1, <2.7.32 || >=3.0-RC1, <3.14.16 || >=4.0-M1, <4.7.5 || >=5.0-M1, <5.2.3 · fixed in 1.14.2, 2.7.32, 3.14.16, 4.7.5, 5.2.3

Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

• Path traversal

<7.5.10 · fixed in 7.5.10

Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

• Information disclosure

>=13.0.0.RELEASE, <13.22.0.RELEASE · fixed in 13.22.0.RELEASE

SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information

• CWE-202

>=9.7.0, <10.4.0 · fixed in 10.4.0

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

• Code injection

<3.1.4.RELEASE · fixed in 3.1.4.RELEASE

Improper restriction of the scope of accessible objects in Thymeleaf expressions

• Code injection

<3.1.4.RELEASE · fixed in 3.1.4.RELEASE

OpenRemote has XXE in Velbus Asset Import

• XML external entities (XXE)

<1.22.0 · fixed in 1.22.0

Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

• CWE-670

* · no fixed version yet

Data Sharing Framework is Missing Session Timeout for OIDC Sessions

• Authentication bypass

* · no fixed version yet

Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

• Weak cryptography or TLS

>=1.49, <1.84 · fixed in 1.84

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

• HTTP request smuggling

>=12.1.0, <12.1.7 || >=12.0.0, <12.0.33 || >=11.0.0, <11.0.29 || >=10.0.0, <10.0.28 || >=9.4.0, <9.4.60 · fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60

XWiki's REST APIs can list all pages/spaces, leading to unavailability

• Denial of service

>=1.8-rc-1, <16.10.16 || >=17.0.0-rc-1, <17.4.8 || >=17.5.0-rc-1, <17.10.1 · fixed in 16.10.16, 17.4.8, 17.10.1

XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

• Cross-site scripting (XSS)

>=10.4-rc-1, <16.10.16 || >=17.0.0-rc-1, <17.4.8 || >=17.5.0-rc-1, <17.10.1 · fixed in 16.10.16, 17.4.8, 17.10.1

Expression Injection in OpenRemote

• Code injection

<1.22.0 · fixed in 1.22.0

Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

• Cross-site scripting (XSS)

<=26.5.5 · no fixed version yet

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

• Path traversal

>=2.0.24, <2.0.37 || >=3.0.0, <3.0.8 · fixed in 2.0.37, 3.0.8

AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects

• Information disclosure

>=3.0.0.Beta1, <3.0.9 || >=2.0.0, <2.14.5 · fixed in 3.0.9, 2.14.5

Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

• Authentication bypass
• CWE-226

>=12.1.0, <12.1.8 || >=12.0.0, <12.0.34 · fixed in 12.1.8, 12.0.34

Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

• Command injection
• CWE-116

<8.43.0 · fixed in 8.43.0

Apache Storm: Deserialization of Untrusted Data vulnerability

• Insecure deserialization

<2.8.6 · fixed in 2.8.6