OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

GHSA-crwc-vw2r-qr6m CVE-2026-113730 MODERATE 5 days ago

### Summary OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous...

maven

No PRs yet

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

GHSA-x32g-jvvm-4725 CVE-2026-111762 MODERATE 6 days ago

### *Impact.** Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. An...

maven

No PRs yet

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

GHSA-4fpj-g9jf-9rgg CVE-2026-111765 HIGH 6 days ago

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synch...

maven

No PRs yet

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

GHSA-q78c-5jjq-57g8 CVE-2026-111761 MODERATE 6 days ago

--- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery) - **Affected versi...

maven

No PRs yet

A2A Java SDK has a fail-open default task authorization

GHSA-qw47-mcm5-934w CVE-2026-111764 HIGH 6 days ago

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Se...

maven

No PRs yet

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

GHSA-9rhm-2h4x-jwmx CVE-2026-111763 MODERATE 6 days ago

*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The a...

maven

No PRs yet

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

GHSA-rxjv-24xq-76wc CVE-2026-102834 HIGH 10 days ago

### Summary `IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera with...

maven

No PRs yet

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

GHSA-h9h9-2rmf-rvhp CVE-2026-97370 HIGH 11 days ago

### Summary Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The `RarVM.Exec...

maven

No PRs yet

Hazelcast allows arbitrary member memory access by low-privileged client

GHSA-6v25-8wq6-xq4j CVE-2026-107726 CRITICAL 18 days ago

### Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to rea...

maven

No PRs yet

Hazelcast has an authorization bypass in IMap Predicates API

GHSA-w294-6q5q-53p8 CVE-2026-107725 HIGH 18 days ago

### Impact Missing authorization checks in the [Predicates API](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview) may allow a mal...

maven

No PRs yet

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

GHSA-2jwh-9rmr-j4xf CVE-2026-107228 MODERATE 18 days ago

### Impact With the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader...

maven

No PRs yet

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

GHSA-p2jm-6hj6-9rjg CVE-2026-107226 MODERATE 18 days ago

### Impact The cookie store ignores the scheme a `Set-Cookie` arrived on. draft-ietf-httpbis-rfc6265bis-22 (approved to obsolete RFC 6265, in the R...

maven

No PRs yet

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

GHSA-x8v2-478q-2hvg CVE-2026-107227 HIGH 18 days ago

### Impact With WebSocket compression enabled, the client inflates `permessage-deflate` messages with no limit on the decompressed size. It instal...

maven

No PRs yet

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

GHSA-v2j5-22fr-j62r CVE-2026-107230 HIGH 18 days ago

### Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection...

maven

No PRs yet

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

GHSA-mfj3-87qq-382v CVE-2026-107283 LOW 18 days ago

### Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom numb...

maven

No PRs yet

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

GHSA-3wp9-xfwm-rjjf CVE-2026-107285 MODERATE 18 days ago

### Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTT...

maven

No PRs yet

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

GHSA-f9m8-cv68-674w CVE-2026-107280 MODERATE 18 days ago

### Impact The cookie store decides whether a `Domain` attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, whi...

maven

No PRs yet

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

GHSA-jmqq-x5g9-9p2w CVE-2026-107282 CRITICAL 18 days ago

### Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at ...

maven

No PRs yet

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

GHSA-rqf5-2wxv-rjf4 CVE-2026-107231 HIGH 18 days ago

### Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with `Authorization: B...

maven

No PRs yet

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

GHSA-cqgh-8p3p-mx4m CVE-2026-106121 MODERATE 19 days ago

## Summary `com.rabbitmq.tools.json.JSONReader.read()` never returns when its input ends inside a quoted string or a `//` line comment. Both scann...

maven

No PRs yet

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

GHSA-mcr4-qmvw-px4g CVE-2026-106451 HIGH 19 days ago

### Summary When no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled native library to `java.io.tmpd...

maven

1

Dependabot PRs

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

GHSA-343h-94h5-c4wr CVE-2026-106449 LOW 19 days ago

### Summary When `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles...

maven

1

Dependabot PRs

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

GHSA-gm45-99xc-r7wv CVE-2026-106450 MODERATE 19 days ago

### Summary `LZ4FrameInputStream` allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame heade...

maven

1

Dependabot PRs

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

GHSA-7822-rcf6-97fx CVE-2026-106122 MODERATE 19 days ago

### Summary A single AMQP message with malformed UTF-8 in a shortstr property (for example `correlation-id`) can permanently disable a Java client...

maven

No PRs yet

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

GHSA-h6w7-qmcm-q6xr CVE-2026-106123 MODERATE 19 days ago

### Summary When property-file/Map-based `ConnectionFactory` setup fails while parsing the `uri` key, the library wraps the underlying exception wi...

maven

No PRs yet

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

GHSA-4v53-57pg-c464 CVE-2026-106452 MODERATE 19 days ago

### Summary `LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` st...

maven

No PRs yet

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

GHSA-6cx8-rjf8-pr8g CVE-2026-106453 MODERATE 19 days ago

### Summary `LZ4DecompressorWithLength.decompress(byte[], int)` allocates whatever size the 4-byte length header declares, before it reads a singl...

maven

No PRs yet

Snowflake drivers writes sensitive information to logs

GHSA-qqj6-54q6-cxv6 CVE-2026-86597 MODERATE 21 days ago

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication toke...

go maven npm +1 more

No PRs yet

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

GHSA-rvm3-566m-v7fv CVE-2026-103922 CRITICAL 21 days ago

### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTT...

maven npm swift

No PRs yet

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

GHSA-xm28-xvqc-gxxg CVE-2026-61586 HIGH 24 days ago

Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enab...

maven

No PRs yet

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

GHSA-7hhh-6rmp-j9qf CVE-2026-89425 HIGH 25 days ago

## Status **FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a 20,000,109-character exception message from a 2...

maven

3

Dependabot PRs

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

GHSA-p6pp-m3f8-5c89 CVE-2026-89407 HIGH 25 days ago

## Status **FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input siz...

maven

No PRs yet

jackson-databind quadratic forward-reference completion

GHSA-cxp5-3px4-pw24 CVE-2026-91777 HIGH 26 days ago

### Summary When an `@JsonIdentityInfo` collection or map first creates N unresolved object-ID references and later resolves the same IDs in rever...

maven

14

Dependabot PRs

jackson-databind retains every unknown raw type ID

GHSA-wv8q-qhhj-9h54 CVE-2026-91776 HIGH 26 days ago

### Summary With `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown raw type ID selects the same fallback deserializer but ...

maven

13

Dependabot PRs

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

GHSA-gx83-3vf8-gh7j CVE-2026-83557 MODERATE 28 days ago

### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeInfo` is applied without an e...

maven

12

Dependabot PRs

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

GHSA-q4xh-88c3-wmh7 CVE-2026-68497 HIGH 28 days ago

### Summary `jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCal...

maven

No PRs yet

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

GHSA-wjgm-6hv5-3cvf CVE-2026-19032 MODERATE 28 days ago

### Summary A `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. The attacker str...

maven

No PRs yet

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

GHSA-vvgp-rfg2-7rr6 CVE-2026-77310 MODERATE 28 days ago

### Summary CVE-2026-54514 (GHSA-hgj6-7826-r7m5) fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of `java.net.Inet...

maven

12

Dependabot PRs

http4s-scala-xml has an XML External Entity (XXE) processing issue

GHSA-cjx3-73hr-rpw7 CVE-2026-61741 CRITICAL about 1 month ago

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. These decoders used a `javax.xml.parsers.SAXP...

maven

No PRs yet

Jawn: Quadratic parsing effort in AsyncParser

GHSA-w4cm-gvhj-cgw6 CVE-2026-61814 HIGH about 1 month ago

`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each `ab...

maven

No PRs yet

Jawn: Uncontrolled nesting depth in JSON parser

GHSA-cc4v-rvgp-2pf3 CVE-2026-59990 HIGH about 1 month ago

The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote attacker who can submit JSON to...

maven

No PRs yet

JLine: ReDoS in Nano Editor Regex Search Mode

GHSA-ph9c-7hw9-vhhw CVE-2026-77421 MODERATE about 1 month ago

### Summary When regex search mode is enabled in the JLine3 `nano` editor, the user-supplied search term is compiled directly as a Java regular ex...

maven

No PRs yet

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

GHSA-r2xf-8xr9-62gw CVE-2026-77422 HIGH about 1 month ago

### Summary The JLine3 built-in `grep` command wraps the user-supplied regular expression with `.*` before compiling it with Java's backtracking r...

maven

No PRs yet

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

GHSA-5q95-hrpc-m3w3 CVE-2026-77420 MODERATE about 1 month ago

### Summary The JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with only partial escaping. As a result, regex metach...

maven

No PRs yet

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

GHSA-5f42-97gr-vfhq CVE-2026-85724 CRITICAL about 1 month ago

moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. ...

maven

No PRs yet

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

GHSA-m9c2-85gv-8xr5 CVE-2026-69190 MODERATE about 1 month ago

### Impact A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashb...

maven

No PRs yet

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

GHSA-7952-gx68-cjqr CVE-2026-65829 MODERATE about 1 month ago

### Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. ### Patches...

maven nuget pypi +1 more

No PRs yet

MPXJ: XXE Vulnerability in MerlinReader

GHSA-5vvx-3h34-f3gj CVE-2026-61570 HIGH about 1 month ago

### Impact MPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing th...

maven nuget pypi +1 more

No PRs yet

io.moquette:moquette-broker has a Missing Authorization issue

GHSA-9jjc-fw8x-fmwx CVE-2026-85058 HIGH about 1 month ago

## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of ...

maven

No PRs yet

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

GHSA-26vp-8gxg-v4pg CVE-2025-53837 CRITICAL about 1 month ago

### Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macro...

maven

No PRs yet