Maven Advisories.

Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

• Command injection
• Code injection

>=1.0.0, <1.0.5 || >=1.1.0-M1, <1.1.4 · fixed in 1.0.5, 1.1.4

Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

• CWE-280

<26.5.6 · fixed in 26.5.6

Keycloak: manage-clients permission escalates to full realm admin access

• Privilege escalation

<26.5.6 · fixed in 26.5.6

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

• Denial of service

<4.1.132.Final || >=4.2.0.Alpha1, <4.2.11.Final · fixed in 4.1.132.Final, 4.2.11.Final

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

• HTTP request smuggling

<4.1.132.Final || >=4.2.0.Alpha1, <4.2.10.Final · fixed in 4.1.132.Final, 4.2.10.Final

splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

• Insecure deserialization
• CWE-1395

<2.26.1 · fixed in 2.26.1

dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

• Insecure deserialization

>=0.40.0, <1.60.3 · fixed in 1.60.3

Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation

• Server-side request forgery (SSRF)

>=26.5.0, <26.6.3 || <26.4.13 · fixed in 26.6.3, 26.4.13

pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

• Path traversal

<3.14.1 · fixed in 3.14.1

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

• Insecure deserialization

<2.26.1 · fixed in 2.26.1

Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

• Path traversal

>=4.0.0, <4.0.3 || <3.6.1 · fixed in 4.0.3, 3.6.1

sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

• Command injection

>=0.9.5, <1.12.8 · fixed in 1.12.8

Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol

• Broken access control

>=2.0.0, <2.53.0 · fixed in 2.53.0

Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests

• Denial of service

* · no fixed version yet

Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

• Path traversal

>=4.3.0, <4.3.2 || >=5.0.0-M1, <5.0.2 || >=4.2.0, <=4.2.4 || >=4.0.0, <=4.1.7 || <=3.1.10 · fixed in 4.3.2, 5.0.2

Keycloak's identity-first login flow exposes user information

• Information disclosure

>=26.5.0, <26.6.1 || <26.4.12 · fixed in 26.6.1, 26.4.12

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

• Broken access control

<=26.6.0 · no fixed version yet

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

• Authentication bypass

>=4.0.0-M1, <4.0.4 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.13 || >=3.0.0, <=3.3.13 || <=2.7.18 · fixed in 4.0.4, 3.5.12

Spring Security HTTP Headers Are not Written Under Some Conditions

• Broken access control

<=5.7.14 || >=5.8.0, <=5.8.16 || >=6.0.0, <=6.3.10 || >=6.4.0, <=6.4.13 || >=6.5.0, <6.5.9 || >=7.0.0, <7.0.4 · fixed in 6.5.9, 7.0.4

Spring Boot has an Authentication Bypass under Actuator Health groups paths

• Authentication bypass

>=3.4.0, <=3.4.13 || >=3.5.0, <3.5.12 || >=4.0.0-M1, <4.0.4 · fixed in 3.5.12, 4.0.4

Spring MVC and WebFlux has Server Sent Event stream corruption

• CWE-667

>=7.0.0-M1, <7.0.6 || >=6.2.0, <6.2.17 || >=6.0.0, <=6.1.21 || >=5.3.0, <=5.3.39 · fixed in 7.0.6, 6.2.17

Spring Framework Improper Path Limitation with Script View Templates

• Path traversal

>=7.0.0-M1, <7.0.6 || >=6.2.0, <6.2.17 || >=6.0.0, <=6.1.21 || >=5.3.0, <=5.3.39 · fixed in 7.0.6, 6.2.17

HAPI FHIR HTTP authentication leak in redirects

• Information disclosure

<6.9.0 · fixed in 6.9.0

Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

• Path traversal

<2.38.0 · fixed in 2.38.0

Jenkins has a link following vulnerability allows arbitrary file creation

• Path traversal
• CWE-61

<2.555 · fixed in 2.555

Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files

• Information disclosure

<2.2 · fixed in 2.2

Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

• CWE-346
• CWE-350

>=2.442, <2.555 · fixed in 2.555

Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form

• Information disclosure

<2.2 · fixed in 2.2

SQL Injection in Spring AI MariaDBFilterExpressionConverter

• SQL injection

>=1.1.0-M1, <1.1.3 || <1.0.4 · fixed in 1.1.3, 1.0.4

JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

• Code injection

>=1.1.0-M1, <1.1.3 || <1.0.4 · fixed in 1.1.3, 1.0.4

Keycloak: Denial of Service due to excessive SAMLRequest decompression

• CWE-409

<26.5.4 · fixed in 26.5.4

Keycloak: Unauthorized authentication via disabled SAML Identity Provider

• Authentication bypass

<26.5.5 · fixed in 26.5.5

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

• CWE-1287

<26.2.14 || >=26.3.0, <26.4.10 || >=26.5.0, <26.5.5 · fixed in 26.2.14, 26.4.10, 26.5.5

Micronaut Framework vulnerable to a Denial of Service in HTML error response caching

• Denial of service

>=4.7.0, <4.10.17 · fixed in 4.10.17

Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

• Denial of service

>=4.0.0-M1, <4.10.16 || >=3.9.0, <3.10.5 || <3.8.13 · fixed in 4.10.16, 3.10.5, 3.8.13

Apache Spark: Spark History Server Code Execution Vulnerability

• Insecure deserialization

<=2.2.3 · no fixed version yet

Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames

• Server-side request forgery (SSRF)

>=2025.1.6, <2025.2.4 || >=2025.3.0, <2025.3.1 || >=2025.4.0, <2025.4.1 · fixed in 2025.2.4, 2025.3.1, 2025.4.1

Apache Livy: Restrict file access

• CWE-20

>=0.7.0-incubating, <0.9.0-incubating · fixed in 0.9.0-incubating

Apache Livy: Unauthorized directory access

• Path traversal

>=0.3.0-incubating, <0.9.0-incubating · fixed in 0.9.0-incubating

Keycloak vulnerable to authorization bypass via the Admin API

• Broken access control

<=26.5.5 · no fixed version yet

Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API

• Broken access control

<=26.5.6 · no fixed version yet

Keycloak: Information disclosure of disabled user attributes via administrative endpoint

• Information disclosure

<=26.5.5 · no fixed version yet

Vaadin: Specially crafted ZIP archives can escape the intended extraction directory

• Path traversal

>=14.2.0, <14.14.1 || >=23.0.0, <23.6.7 || >=24.0.0, <24.9.9 || >=25.0.0, <25.0.3 · fixed in 14.14.1, 23.6.7, 24.9.9, 25.0.3

Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash

• Broken access control

<14.14.1 || >=23.0.0, <23.6.7 || >=24.0.0, <24.9.8 || >=25.0.0, <25.0.2 · fixed in 14.14.1, 23.6.7, 24.9.8, 25.0.2

Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function

• Path traversal

>=2.0.24, <3.0.7 · fixed in 3.0.7

Apache IoTDB has an Insecure Default Configuration Vulnerability

• CWE-1327

>=1.0.0, <1.3.7 || >=2.0.0, <2.0.7 · fixed in 1.3.7, 2.0.7

Apache IoTDB has an Improper Input Validation vulnerability

• Code injection
• CWE-20

>=1.0.0, <1.3.7 || >=2.0.0, <2.0.7 · fixed in 1.3.7, 2.0.7

Apache ZooKeeper has improper handling of configuration values

• Other injection
• Information disclosure

>=3.9.0, <3.9.5 || >=3.8.0, <3.8.6 · fixed in 3.9.5, 3.8.6

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

• Weak cryptography or TLS
• CWE-350

>=3.8.0, <3.8.6 || >=3.9.0, <3.9.5 · fixed in 3.8.6, 3.9.5

org.eclipse.jetty:jetty-http has different parsing of invalid URIs

• CWE-20

>=9.4.0, <=9.4.58 || >=10.0.0, <=10.0.26 || >=11.0.0, <=11.0.26 || >=12.0.0, <12.0.31 || >=12.1.0, <12.1.5 · fixed in 12.0.31, 12.1.5

Cloudfoundry UAA has logic error in the token revocation endpoint implementation

• CWE-640
• CWE-693

>=77.30.0, <78.8.0 · fixed in 78.8.0

Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator

• Broken access control

<26.5.5 · fixed in 26.5.5

Keycloak SAML Broken has Authentication Bypass by Primary Weakness

• CWE-305

<=1.8.1.Final · no fixed version yet

The Eclipse Jetty Server Artifact has a Gzip request memory leak

• Denial of service

>=12.1.0, <12.1.6 || >=12.0.0, <12.0.32 · fixed in 12.1.6, 12.0.32

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

• Weak cryptography or TLS

>=6.0.4.1, <6.3.3 || >=5.0.0-RC1, <5.7.9 || <4.5.9 · fixed in 6.3.3, 5.7.9, 4.5.9

jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

• Denial of service
• CWE-1284

>=3.0.0, <3.1.0 · fixed in 3.1.0

XWiki Blog Application home page vulnerable to Stored XSS via Post Title

• Cross-site scripting (XSS)
• CWE-116

>=9.15, <9.15.7 · fixed in 9.15.7

Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

• Authentication bypass

>=2.11.0, <=2.44.0 · no fixed version yet

Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

• Memory corruption

<5.19.2 || >=6.0.0, <6.1.9 || >=6.2.0, <6.2.1 · fixed in 5.19.2, 6.1.9, 6.2.1

Apache Ranger has a Code Injection vulnerability

• Code injection

<2.8.0 · fixed in 2.8.0