Maven Advisories.

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

• Denial of service

>=4.0.0, <4.3.1 || >=3.0.0, <3.30.15 · fixed in 4.3.1, 3.30.15

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

• Denial of service

>=4.0.0, <4.3.1 || >=3.0.0, <3.30.15 · fixed in 4.3.1, 3.30.15

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

• Denial of service
• Broken access control

<0.18.1 · fixed in 0.18.1

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

• Broken access control

>=6.3.0, <6.3.14 || >=7.0.0, <7.0.9 || >=7.1.0, <7.1.4 · fixed in 6.3.14, 7.0.9, 7.1.4

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

• Path traversal

>=7.3.0, <16.5.0 · fixed in 16.5.0

MPXJ: XXE Vulnerability in MerlinReader

• XML external entities (XXE)

>=5.5.5, <16.4.1 · fixed in 16.4.1

io.moquette:moquette-broker has a Missing Authorization issue

• Broken access control

<0.18.1 · fixed in 0.18.1

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

• Code injection

<14.10.2 · fixed in 14.10.2

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

• Cross-site scripting (XSS)

<19.7 || >=20.0, <20.2 · fixed in 19.7, 20.2

Duplicate Advisory: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

• Memory corruption

<=1.1.10.8 · no fixed version yet

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

• Denial of service
• CWE-20

<6.9.12 · fixed in 6.9.12

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

• Denial of service
• CWE-20

<6.9.12 · fixed in 6.9.12

AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

• Information disclosure
• Hard-coded credentials

>=3.0.9, <3.0.12 || >=2.14.5, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

• Denial of service
• CWE-409

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

• Authentication bypass
• CWE-390

>=3.0.8, <3.0.12 · fixed in 3.0.12

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

• Authentication bypass

<2.0.0 · fixed in 2.0.0

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

• Server-side request forgery (SSRF)

<=1.3.31 · no fixed version yet

Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

• Path traversal

<7.6.1 · fixed in 7.6.1

MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

• Broken access control

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

• Memory corruption

<6.4.5 || >=7.0.0-alpha01, <7.0.0-alpha04 · fixed in 6.4.5, 7.0.0-alpha04

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

• Denial of service

<5.34.0 · fixed in 5.34.0

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

• Denial of service

<0.23.37 · fixed in 0.23.37

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

• Path traversal

<0.23.35 · fixed in 0.23.35

Http4s Ember HTTP/2: unbounded continuation frame accumulation

• Denial of service

<0.23.35 · fixed in 0.23.35

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

• HTTP request smuggling

<0.23.35 · fixed in 0.23.35

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

• CWE-565
• CWE-1275

<0.23.35 · fixed in 0.23.35

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

• Authentication bypass
• CWE-565

<0.23.35 · fixed in 0.23.35

Http4s Ember HTTP/2 has an unbounded outbound frame queue

• Denial of service

<0.23.35 · fixed in 0.23.35

Http4s: DigestAuth nonce map grows unbounded

• Denial of service

<0.23.35 · fixed in 0.23.35

Http4s: DigestAuth allows replay of captured requests

• Authentication bypass

<0.23.35 · fixed in 0.23.35

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

• HTTP request smuggling

<0.23.35 · fixed in 0.23.35

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

• HTTP request smuggling

<0.23.35 · fixed in 0.23.35

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

• Denial of service

<0.23.35 · fixed in 0.23.35

Http4s Ember HTTP/2: unbounded inbound body buffering

• Denial of service

<0.23.35 · fixed in 0.23.35

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

• CWE-322

<0.84.0 · fixed in 0.84.0

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

• Hard-coded credentials

<0.84.0 · fixed in 0.84.0

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

• Other injection

<0.84.0 · fixed in 0.84.0

Apache FreeMarker template loading mechanism vulnerable to path traversal

• Path traversal

>=2.2.0, <2.3.35 · fixed in 2.3.35

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

• Server-side request forgery (SSRF)

>=4.4.0, <4.4.12 || >=4.0.0, <4.2.17 · fixed in 4.4.12, 4.2.17

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

• CWE-475
• CWE-754

>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

• Denial of service

>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final · fixed in 4.2.17.Final, 4.1.137.Final

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

• Path traversal
• Information disclosure

<4.5.3 · fixed in 4.5.3

jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input

• CWE-184

<2.6.2 · fixed in 2.6.2

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

• Weak cryptography or TLS
• Hard-coded credentials

<1.4.1 · fixed in 1.4.1

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

• CWE-116
• CWE-838

<1.4.1 · fixed in 1.4.1

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

• CWE-838

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

• Weak cryptography or TLS
• Hard-coded credentials

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

• Hard-coded credentials

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

MapFish Print has XXE that allows reading arbitrary files of certain types

• XML external entities (XXE)

>=3.0.0, <3.28.30 || >=3.29.0, <3.30.32 || >=3.32.0, <3.33.16 || >=3.34.0, <4.0.5 · fixed in 3.28.30, 3.30.32, 3.33.16, 4.0.5

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

• Broken access control

>=6.2.0, <6.3.12 || >=7.0.0, <7.0.7 || >=7.1.0, <7.1.2 · fixed in 6.3.12, 7.0.7, 7.1.2

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

• CWE-138

<6.3.12 || >=7.0.0, <7.0.7 || >=7.1.0, <7.1.2 · fixed in 6.3.12, 7.0.7, 7.1.2

PowSyBl Core has Command Injection in LocalCommandExecutor-s

• Command injection

<7.2.2 · fixed in 7.2.2

Spinnaker: Improper yaml processing on kustomize bake operations

• Insecure deserialization

<2025.3.4 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3 || >=2026.1.0, <2026.1.1 · fixed in 2025.3.4, 2025.4.4, 2026.0.3, 2026.1.1

Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields

• CWE-213

>=7.1.0, <7.1.4 · fixed in 7.1.4

Yamcs has DOM XSS in Extension Routing

• Cross-site scripting (XSS)

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

• Code injection

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

• Code injection

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs has Unauthenticated Directory Traversal

• Path traversal

<5.12.0 · fixed in 5.12.0

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

• Cross-site scripting (XSS)

<5.9.4 · fixed in 5.9.4