Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

GHSA-rr8v-fxxf-c986 CVE-2026-75598 HIGH about 24 hours ago

### Summary ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malici...

maven

No PRs yet

JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS

GHSA-ghc9-756g-vrcv CVE-2026-59171 MODERATE 1 day ago

## 1. Executive Summary JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded `BigInteger` and `BigDecimal`...

maven

4

Dependabot PRs

zt-zip: ZipUtil.unpack can change file permissions of output directory

GHSA-v2g6-7r9j-v6px CVE-2026-63499 MODERATE 1 day ago

### Summary When using one of the `ZipUtil.unpack` overloads, the file permissions of the output directory can be changed. For example, when the ou...

maven

No PRs yet

zt-zip: Path traversal in fluent API unpack

GHSA-52c6-99qm-3hqr CVE-2026-63436 HIGH 1 day ago

### Summary `ZipUtil.unpack(...)` rejects ZIP entries that escape the target output directory, but the `Zips` fluent API appears to use a separate...

maven

No PRs yet

Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration

GHSA-92r3-p8c2-3fpx CVE-2026-16454 MODERATE 4 days ago

## **Description** A privilege escalation vulnerability has been identified in the Direct Device Integration (DDI) Controller of **Eclipse hawkBit*...

maven

No PRs yet

Keycloak has authentication bypass via jwt algorithm confusion

GHSA-j97h-3f8r-mrjr CVE-2026-11800 HIGH 7 days ago

### Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker wit...

maven

No PRs yet

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

GHSA-h599-m3w5-9m7x CVE-2026-119276 MODERATE 11 days ago

## Summary MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in ...

maven

No PRs yet

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

GHSA-797x-p4mc-jwpm CVE-2026-119279 MODERATE 11 days ago

## Summary MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to `int` without validation. A rogue or MitM serve...

maven

No PRs yet

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

GHSA-4jq2-8v3c-97w8 CVE-2026-119280 LOW 11 days ago

## Summary `XAResource.recover()` in MariaDB Connector/J trusted the `gtrid_length` and `bqual_length` columns returned by `XA RECOVER` to allocat...

maven

No PRs yet

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

GHSA-fhx5-2xqw-2cgm CVE-2026-119210 MODERATE 11 days ago

## Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for `LOAD D...

maven

No PRs yet

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

GHSA-grfq-r75j-rw9x CVE-2026-119281 MODERATE 11 days ago

## Summary MariaDB Connector/J decodes every result as UTF-8 and guards `character_set_client` against a change to another charset, but did not gu...

maven

No PRs yet

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

GHSA-c6q7-wqw2-h65w CVE-2026-54442 MODERATE 11 days ago

### Summary The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and s...

maven

No PRs yet

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

GHSA-v3f7-2p4r-mwfw CVE-2026-9086 HIGH 12 days ago

### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission ...

maven

No PRs yet

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

GHSA-9jrw-8xf7-xqhq CVE-2026-9083 MODERATE 12 days ago

### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an ar...

maven

No PRs yet

Keycloak allows unauthorized access to resources via uma permission ticket bypass

GHSA-w3p3-7cjg-vgfw CVE-2026-9799 MODERATE 12 days ago

### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket fo...

maven

No PRs yet

Keycloak vulnerable to authorization bypass via incorrect uri comparison

GHSA-f5p5-6xmx-p252 CVE-2026-9800 HIGH 12 days ago

### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies...

maven

No PRs yet

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

GHSA-r7rc-c989-86g6 CVE-2026-9705 MODERATE 12 days ago

### Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access T...

maven

No PRs yet

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

GHSA-ccrj-gw8r-854m CVE-2026-118259 MODERATE 13 days ago

### Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, pote...

maven

2

Dependabot PRs

snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

GHSA-gwq9-9ffj-mvrv CVE-2026-93451 HIGH 14 days ago

### Impact `Snappy.uncompressCharArray`, `uncompressShortArray`, `uncompressIntArray`, `uncompressLongArray`, `uncompressFloatArray` and `uncompres...

maven

No PRs yet

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

GHSA-xqrx-qh46-34m7 CVE-2026-116590 MODERATE 14 days ago

### Impact `Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset)` called a native `memcpy` without validating the ...

maven

No PRs yet

snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

GHSA-q233-g92q-qxp6 CVE-2026-108106 HIGH 14 days ago

### Impact Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the...

maven

No PRs yet

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

GHSA-xxph-c9ww-hj94 CVE-2026-102554 HIGH 14 days ago

# CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation ## Summary `CompactHashMap`, `...

maven

4

Dependabot PRs

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

GHSA-crwc-vw2r-qr6m CVE-2026-113730 MODERATE 20 days ago

### Summary OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous...

maven

No PRs yet

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

GHSA-x32g-jvvm-4725 CVE-2026-111762 MODERATE 21 days ago

### *Impact.** Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. An...

maven

No PRs yet

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

GHSA-4fpj-g9jf-9rgg CVE-2026-111765 HIGH 21 days ago

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synch...

maven

No PRs yet

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

GHSA-q78c-5jjq-57g8 CVE-2026-111761 MODERATE 21 days ago

--- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery) - **Affected versi...

maven

No PRs yet

A2A Java SDK has a fail-open default task authorization

GHSA-qw47-mcm5-934w CVE-2026-111764 HIGH 21 days ago

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Se...

maven

No PRs yet

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

GHSA-9rhm-2h4x-jwmx CVE-2026-111763 MODERATE 21 days ago

*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The a...

maven

No PRs yet

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

GHSA-rxjv-24xq-76wc CVE-2026-102834 HIGH 25 days ago

### Summary `IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera with...

maven

No PRs yet

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

GHSA-h9h9-2rmf-rvhp CVE-2026-97370 HIGH 26 days ago

### Summary Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The `RarVM.Exec...

maven

No PRs yet

Hazelcast allows arbitrary member memory access by low-privileged client

GHSA-6v25-8wq6-xq4j CVE-2026-107726 CRITICAL about 1 month ago

### Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to rea...

maven

No PRs yet

Hazelcast has an authorization bypass in IMap Predicates API

GHSA-w294-6q5q-53p8 CVE-2026-107725 HIGH about 1 month ago

### Impact Missing authorization checks in the [Predicates API](https://docs.hazelcast.com/hazelcast/5.7/query/predicate-overview) may allow a mal...

maven

No PRs yet

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

GHSA-2jwh-9rmr-j4xf CVE-2026-107228 MODERATE about 1 month ago

### Impact With the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader...

maven

No PRs yet

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

GHSA-p2jm-6hj6-9rjg CVE-2026-107226 MODERATE about 1 month ago

### Impact The cookie store ignores the scheme a `Set-Cookie` arrived on. draft-ietf-httpbis-rfc6265bis-22 (approved to obsolete RFC 6265, in the R...

maven

No PRs yet

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

GHSA-x8v2-478q-2hvg CVE-2026-107227 HIGH about 1 month ago

### Impact With WebSocket compression enabled, the client inflates `permessage-deflate` messages with no limit on the decompressed size. It instal...

maven

No PRs yet

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

GHSA-v2j5-22fr-j62r CVE-2026-107230 HIGH about 1 month ago

### Impact The fix for GHSA-vvp4-63h8-v5pm in 3.0.13 folded the authenticated principal into the HTTP/1.1 connection pool key, so that a connection...

maven

No PRs yet

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

GHSA-mfj3-87qq-382v CVE-2026-107283 LOW about 1 month ago

### Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom numb...

maven

No PRs yet

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

GHSA-3wp9-xfwm-rjjf CVE-2026-107285 MODERATE about 1 month ago

### Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTT...

maven

No PRs yet

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

GHSA-f9m8-cv68-674w CVE-2026-107280 MODERATE about 1 month ago

### Impact The cookie store decides whether a `Domain` attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, whi...

maven

No PRs yet

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

GHSA-jmqq-x5g9-9p2w CVE-2026-107282 CRITICAL about 1 month ago

### Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at ...

maven

No PRs yet

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

GHSA-rqf5-2wxv-rjf4 CVE-2026-107231 HIGH about 1 month ago

### Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with `Authorization: B...

maven

No PRs yet

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

GHSA-cqgh-8p3p-mx4m CVE-2026-106121 MODERATE about 1 month ago

## Summary `com.rabbitmq.tools.json.JSONReader.read()` never returns when its input ends inside a quoted string or a `//` line comment. Both scann...

maven

No PRs yet

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

GHSA-mcr4-qmvw-px4g CVE-2026-106451 HIGH about 1 month ago

### Summary When no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled native library to `java.io.tmpd...

maven

1

Dependabot PRs

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

GHSA-343h-94h5-c4wr CVE-2026-106449 LOW about 1 month ago

### Summary When `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles...

maven

1

Dependabot PRs

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

GHSA-gm45-99xc-r7wv CVE-2026-106450 MODERATE about 1 month ago

### Summary `LZ4FrameInputStream` allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame heade...

maven

1

Dependabot PRs

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

GHSA-7822-rcf6-97fx CVE-2026-106122 MODERATE about 1 month ago

### Summary A single AMQP message with malformed UTF-8 in a shortstr property (for example `correlation-id`) can permanently disable a Java client...

maven

No PRs yet

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

GHSA-h6w7-qmcm-q6xr CVE-2026-106123 MODERATE about 1 month ago

### Summary When property-file/Map-based `ConnectionFactory` setup fails while parsing the `uri` key, the library wraps the underlying exception wi...

maven

No PRs yet

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

GHSA-4v53-57pg-c464 CVE-2026-106452 MODERATE about 1 month ago

### Summary `LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` st...

maven

No PRs yet

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

GHSA-6cx8-rjf8-pr8g CVE-2026-106453 MODERATE about 1 month ago

### Summary `LZ4DecompressorWithLength.decompress(byte[], int)` allocates whatever size the 4-byte length header declares, before it reads a singl...

maven

No PRs yet

Snowflake drivers writes sensitive information to logs

GHSA-qqj6-54q6-cxv6 CVE-2026-86597 MODERATE about 1 month ago

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication toke...

go maven npm +1 more

No PRs yet