Maven Advisories.

Spring HATEOAS heap exhaustion through unbounded internal caching

• Denial of service

>=3.0.0, <3.0.4 || >=2.5.0, <2.5.3 || >=2.3.0, <=2.3.4 || <=1.5.6 || >=2.4.0, <=2.4.1 · fixed in 3.0.4, 2.5.3

Spring Framework Cross-site Scripting via JavaScriptUtils

• Cross-site scripting (XSS)

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service

• Denial of service

>=2.0.0, <2.0.13 || <=1.3.4 · fixed in 2.0.13

Micrometer gRPC server instrumentation DoS

• Denial of service

>=1.16.0, <1.16.6 || >=1.15.0, <1.15.12 · fixed in 1.16.6, 1.15.12

Micrometer HTTP server instrumentations DoS

• Denial of service

>=1.16.0, <1.16.6 || >=1.15.0, <1.15.12 || >=1.14.0, <=1.14.14 || >=1.10.0, <=1.13.15 || <=1.9.17 · fixed in 1.16.6, 1.15.12

Netty has Insufficient Bailiwick Validation for NS Records

• CWE-345
• CWE-346

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: SCTP reassembly nests buffers without bound

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

• CWE-345
• CWE-346

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

• Weak cryptography or TLS
• CWE-340

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

• Information disclosure
• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty's Default QUIC token handler accepts any client-supplied token

• CWE-346
• CWE-940

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

• Memory corruption
• CWE-703

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

• Denial of service
• CWE-1188

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

Netty has Unbounded Direct Memory Consumption in its RedisDecoder

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

• Broken access control
• CWE-697

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

hsweb-framework has an open redirect issue

• Open redirect

<=5.0.1 · no fixed version yet

hsweb-framework has a Path Traversal issue

• Path traversal

<=5.0.1 · no fixed version yet

Keycloak: Information disclosure due to user profile permission bypass

• CWE-1220

<26.7.0 · fixed in 26.7.0

Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

• Insecure deserialization

<1.1.0 · fixed in 1.1.0

epa4all-client: Unauthenticated REST API for Patient Record Writes

• Authentication bypass

<=1.2.4 · no fixed version yet

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

• Insecure deserialization

>=2.2.0, <2.2.8 || >=2.1.0, <2.1.13 || <2.0.29 · fixed in 2.2.8, 2.1.13, 2.0.29

Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes

• Code injection

>=1.5.0, <1.42.0 · fixed in 1.42.0

Spring Cloud Function Context has Uncontrolled Recursion

• Denial of service

>=4.3.0, <4.3.3 || >=5.0.0, <5.0.2 || >=3.2.10, <=3.2.15 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.5 · fixed in 4.3.3, 5.0.2

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

• Denial of service

>=4.3.0, <4.3.3 || >=5.0.0, <5.0.2 || >=3.2.10, <=3.2.15 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.5 · fixed in 4.3.3, 5.0.2

Logback vulnerable to Object Injection through HardenedObjectInputStream modules

• Insecure deserialization

<1.5.34 · fixed in 1.5.34

Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

• Server-side request forgery (SSRF)

<2.0.2-incubating · fixed in 2.0.2-incubating

Apache MINA SSHD bundle sshd-git has a path traversal vulnerability

• Path traversal

<2.18.0 || >=3.0.0-M1, <3.0.0-M4 · fixed in 2.18.0, 3.0.0-M4

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability

• CWE-1230

<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6

Apache ActiveMQ server has an incomplete authorization workflow

• Broken access control

<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

• Broken access control

<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6

Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer

• Denial of service

>=0.8.0-incubating-rc1, <0.9.1-incubating · fixed in 0.9.1-incubating

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

• Code injection
• CWE-20

<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6

Apache Solr has hardcoded credentials in the Basic Authentication setup tool

• Hard-coded credentials
• CWE-1188

>=9.4.0, <=9.10.1 · no fixed version yet

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

• Code injection
• CWE-20

<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6

Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue

• Cross-site scripting (XSS)

<5.19.7 || >=6.0.0, <6.2.6 · fixed in 5.19.7, 6.2.6

Apache Directory LDAP API lacks server certificate verification for LDAP hostnames

• Weak cryptography or TLS

>=2.0.0, <2.1.8 · fixed in 2.1.8

CC-Tweaked has an SSRF Protection Bypass with NAT64

• Server-side request forgery (SSRF)

<1.119.0 · fixed in 1.119.0

Apache Artemis has an Incorrect Authorization issue

• Broken access control

>=2.50.0, <2.54.0 || >=2.0.0, <=2.44.0 · fixed in 2.54.0

QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability

• Insecure deserialization

<1.5.33 · fixed in 1.5.33

Apache Ignite REST API Has a Relative Path Traversal Vulnerability

• Path traversal

>=2.0.0, <2.18.0 · fixed in 2.18.0

Keycloak has Insufficient Session Expiration

• Authentication bypass

<=26.4.7 || >=26.5.0, <26.6.3 · fixed in 26.6.3

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

• CWE-1284

<26.6.3 · fixed in 26.6.3

Keycloak has an Out-of-bounds Read

• Memory corruption

<=26.4.7 || >=26.5.0, <26.6.3 · fixed in 26.6.3

Keycloak has an Authentication Bypass by Primary Weakness

• CWE-305

<=26.4.7 || >=26.5.0, <=26.6.4 · no fixed version yet

Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

• Race condition

<26.6.4 · fixed in 26.6.4

Keycloak has an Improper Verification of Cryptographic Signature issue

• Weak cryptography or TLS

<=26.6.4 · no fixed version yet

Keycloak Generates an Error Message Containing Sensitive Information

• Information disclosure

<=26.4.7 || >=26.5.0, <26.6.3 · fixed in 26.6.3

Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement

• Privilege escalation

<26.6.4 · fixed in 26.6.4

Keycloak Vulnerable to Incorrect Authorization

• Broken access control

>=26.5.0, <26.6.3 || <=26.4.7 · fixed in 26.6.3

Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

• CWE-280

>=26.5.0, <26.6.3 || <=26.4.7 · fixed in 26.6.3

Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

• Code injection

<5.12.7 · fixed in 5.12.7

Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override

• Code injection

<5.12.7 · fixed in 5.12.7

Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability

• Cross-site request forgery (CSRF)

<669.v9d96a · fixed in 669.v9d96a

Jenkins buildgraph-view Plugin does not escape the build URL

• Cross-site scripting (XSS)

<=1.8 · no fixed version yet

Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

• Cross-site request forgery (CSRF)

<0.7.4 · fixed in 0.7.4

Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login

• Open redirect

<0.18 · fixed in 0.18

Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

• Privilege escalation

<143.145.v48f9a · fixed in 143.145.v48f9a