Maven Advisories.

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

• Weak cryptography or TLS

<1.0.2.7 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.3 · fixed in 1.0.2.7, 2.0.2, 2.1.3

core-geonetwork has an Open Redirect Bypass

• Open redirect

>=3.12.0, <=3.12.12 || >=4.0.0-alpha.1, <=4.0.6 || >=4.2.0, <4.2.16 || >=4.4.0, <4.4.11 · fixed in 4.2.16, 4.4.11

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

• Denial of service

>=4.2.0, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

• Denial of service

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.13 · fixed in 4.0.6, 3.5.12

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

• Denial of service

>=5.0-alpha1, <5.6.3 · fixed in 5.6.3

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

• Information disclosure

<2.28.0-alpha · fixed in 2.28.0-alpha

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

• Denial of service

<2.27.0 · fixed in 2.27.0

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

• Authentication bypass
• Broken access control

<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0 · fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0

veraPDF Parser DoS via PostScript Type 1 Font Programs

• CWE-1325

<1.30.2 || >=1.31.1, <1.31.23 · fixed in 1.30.2, 1.31.23

veraPDF Parser DoS via PostScript CMap Streams

• CWE-1325

<1.30.2 || >=1.31.1, <1.31.23 · fixed in 1.30.2, 1.31.23

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

• XML external entities (XXE)

>=1.17.35, <1.30.2 || >=1.31.1, <1.31.71 · fixed in 1.30.2, 1.31.71

veraPDF Validation XXE via Rich Text

• XML external entities (XXE)

>=1.25.73, <1.30.2 || >=1.31.1, <1.31.71 · fixed in 1.30.2, 1.31.71

veraPDF Validation XXE via XFA

• XML external entities (XXE)

>=1.17.35, <1.30.2 || >=1.31.1, <1.31.71 · fixed in 1.30.2, 1.31.71

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

• Denial of service
• CWE-406

=1.0.0 · no fixed version yet

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

• Code injection
• Memory corruption

<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0 · fixed in 2.3.6, 3.4.1, 4.9.0

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

• Server-side request forgery (SSRF)
• CWE-441

>=8.2.1, <10.1.1 · fixed in 10.1.1

org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

• Cross-site request forgery (CSRF)

<2.0-rc-1 · fixed in 2.0-rc-1

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

• Denial of service

<0.24.0 · fixed in 0.24.0

OmniFaces: Forged combined-resource IDs and related output/push boundaries

• Cross-site scripting (XSS)
• Information disclosure

<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2 · fixed in 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

• Denial of service

<0.23.18 · fixed in 0.23.18

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

• HTTP request smuggling

<0.23.18 · fixed in 0.23.18

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

• HTTP request smuggling

<0.23.18 || >=1.0.0-M1, <1.0.0-M42 · fixed in 0.23.18, 1.0.0-M42

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

• Broken access control

<5.1.2 · fixed in 5.1.2

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

• Path traversal
• Denial of service

<5.1.2 · fixed in 5.1.2

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

• Code injection

<16.1.2 · fixed in 16.1.2

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

• Cross-site scripting (XSS)

>=13.0.0, <16.1.2 · fixed in 16.1.2

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

• Insecure deserialization

<16.1.2 · fixed in 16.1.2

Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

• Denial of service

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

• Denial of service

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

• Weak cryptography or TLS
• CWE-682

>=1.175.0-devpreview, <=1.204.0-devpreview · no fixed version yet

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

• Memory corruption

<1.11.1 · fixed in 1.11.1

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

• Insecure deserialization
• Broken access control

<0.14.0 · fixed in 0.14.0

fastjson has a remote code execution (RCE) vulnerability

• Insecure deserialization
• CWE-20

>=1.2.68, <=1.2.83 · no fixed version yet

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

• Denial of service

>=10.0.7, <10.0.23 || >=11.0.7, <11.0.23 · fixed in 10.0.23, 11.0.23

Eclipse Jetty: Path parameter traversal

• CWE-647

>=12.0.0, <12.0.35 || >=12.1.0, <12.1.9 · fixed in 12.0.35, 12.1.9

Eclipse Jetty: HTTP Authority/Host mismatch

• CWE-20

>=9.4.0.v20161208, <=9.4.58.v20250814 || >=10.0.0, <=10.0.26 || >=11.0.0, <=11.0.26 || >=12.0.0, <12.0.35 || >=12.1.0, <12.1.9 · fixed in 12.0.35, 12.1.9

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

• Information disclosure

>=12.0.0, <12.0.36 || >=12.1.0, <12.1.10 · fixed in 12.0.36, 12.1.10

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

• Authentication bypass
• CWE-173

>=12.0.0, <12.0.36 || >=12.1.0, <12.1.10 · fixed in 12.0.36, 12.1.10

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

• Other injection

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: STOMP CONNECT Frame Header Injection in Netty

• Other injection

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

• Other injection

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

• Denial of service

<4.1.136.Final · fixed in 4.1.136.Final

Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

• HTTP request smuggling

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

• Denial of service

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

• HTTP request smuggling

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: TOCTOU in OcspServerCertificateValidator

• Race condition

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

• CWE-299

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

• Weak cryptography or TLS

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

• XML external entities (XXE)

>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

• Denial of service

<4.2.16.Final · fixed in 4.2.16.Final

Netty: Security Control Bypass via CORS Short-Circuit Failure

• Broken access control

>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

• Denial of service

>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

• Denial of service

>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

• Denial of service

>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Netty SPDY SETTINGS frame count materializes unbounded settings map

• Denial of service

>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

• Broken access control

>=2.19.0, <2.21.5 || >=2.0.0-RC1, <2.18.9 || >=2.22.0, <2.22.1 · fixed in 2.21.5, 2.18.9, 2.22.1

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

• Denial of service

<2.18.8 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 2.21.4

jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

• Broken access control

>=2.18.0, <2.18.9 || >=2.21.0, <2.21.5 · fixed in 2.18.9, 2.21.5

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

• Broken access control

>=2.15.0, <2.18.8 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 2.21.4

Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

• Broken access control

<1.0.4 · fixed in 1.0.4