OmniFaces: Forged combined-resource IDs and related output/push boundaries

GHSA-fp43-vj7g-pg92 HIGH 3 days ago

## 1. Forged combined-resource IDs `CombinedResourceInfo` accepts a path-derived ID without an authenticity check, inflates it without an output li...

maven

No PRs yet

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

GHSA-7ppr-r889-mcf2 HIGH 3 days ago

## Summary `http4s-blaze-server` aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client...

maven

No PRs yet

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

GHSA-46q4-43ph-c6fr HIGH 3 days ago

### Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, a...

maven

No PRs yet

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

GHSA-mhvj-jhpq-885v HIGH 3 days ago

### Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/...

maven

No PRs yet

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

GHSA-p279-2cqp-84jg CRITICAL 3 days ago

### Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, PlainSASLMechanismHandler ve...

maven

No PRs yet

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

GHSA-68r5-9hpg-7qw9 CRITICAL 3 days ago

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-...

maven

No PRs yet

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

GHSA-wg5r-wc3x-39vc CVE-2026-62379 CRITICAL 3 days ago

## Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (`/authservice`, PLL) accept...

maven

No PRs yet

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

GHSA-vqxv-6xrh-49cp CVE-2026-62280 MODERATE 3 days ago

### Description The OAuth2/OIDC consent page rendered for `display=wap` authorize requests reflected several request-derived values into the HTML r...

maven

No PRs yet

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

GHSA-gf8h-gq53-288j CVE-2026-62263 CRITICAL 3 days ago

### Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `Authenticator...

maven

No PRs yet

Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

GHSA-v74w-7mr3-4qg3 HIGH 3 days ago

### Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated `</` characters) to a Nett...

maven

No PRs yet

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

GHSA-mfg7-5gfp-c4w3 MODERATE 3 days ago

### Summary A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occ...

maven

No PRs yet

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

GHSA-464c-974j-9xm6 LOW 3 days ago

## Summary The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and ...

go maven npm +2 more

No PRs yet

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

GHSA-xx22-p4ch-683r CVE-2026-59949 MODERATE 3 days ago

### Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to c...

maven

1

Dependabot PRs

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

GHSA-w6w4-rjh9-9r58 CVE-2026-55223 MODERATE 4 days ago

### Impact The JDBC spec defines the interface `DataSource`, with a method called `getConnection()`, and `ConnectionPoolDataSource`, with a method...

maven

No PRs yet

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

GHSA-9299-c6m4-mjhc CVE-2024-7708 HIGH 5 days ago

### Impact The original report: > Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service...

maven

No PRs yet

Eclipse Jetty: Path parameter traversal

GHSA-w7x5-g22v-xqhr CVE-2026-8384 MODERATE 5 days ago

### Description (as reported) #### Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave dot-dot path segments unnorm...

maven

No PRs yet

Eclipse Jetty: HTTP Authority/Host mismatch

GHSA-7p3p-8qv8-m2vh CVE-2026-6790 MODERATE 5 days ago

#### Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a ...

maven

No PRs yet

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

GHSA-f4v5-65jj-pcr2 CVE-2026-10051 MODERATE 5 days ago

### Description > FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers) > HttpConnection._trailers Cross-Request Leakage (Never Reset B...

maven

No PRs yet

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

GHSA-2fvj-hgj9-j2gr CVE-2026-10050 HIGH 5 days ago

### Summary The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines...

maven

No PRs yet

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

GHSA-gcjf-9mgh-3p7g CVE-2026-59921 MODERATE 5 days ago

# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder ## 1. Vulnerability Summary | Field | Valu...

maven

No PRs yet

Netty: STOMP CONNECT Frame Header Injection in Netty

GHSA-3g8r-4pfx-jmfh CVE-2026-59920 MODERATE 5 days ago

# Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty ## 1. Vulnerability Summary | Field | Value | |-------|-------| | ...

maven

No PRs yet

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

GHSA-wh89-7897-x99h CVE-2026-59919 MODERATE 5 days ago

# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty ## 1. Vulnerability Summary | Field | Value | |-...

maven

No PRs yet

Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

GHSA-558v-64gr-wgg4 CVE-2026-59901 HIGH 5 days ago

The `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that ...

maven

No PRs yet

Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

GHSA-c69g-56f8-xwqj CVE-2026-59900 MODERATE 5 days ago

Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate...

maven

No PRs yet

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

GHSA-q4f6-jm68-57ww CVE-2026-59899 MODERATE 5 days ago

### Impact `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence...

maven

No PRs yet

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

GHSA-4mp9-239f-g9hg CVE-2026-59898 MODERATE 5 days ago

## Summary An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connecti...

maven

No PRs yet

Netty: TOCTOU in OcspServerCertificateValidator

GHSA-wc96-39fc-566f CVE-2026-56822 HIGH 5 days ago

### Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This...

maven

No PRs yet

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

GHSA-g7hg-vrcf-mvmr CVE-2026-56821 HIGH 5 days ago

### Summary `OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is sti...

maven

No PRs yet

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

GHSA-272m-gcwp-mpwg CVE-2026-56820 HIGH 5 days ago

### Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can re...

maven

No PRs yet

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

GHSA-4qhr-g3c6-fcfx CVE-2026-56817 HIGH 5 days ago

Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declaration to a parser instantia...

maven

No PRs yet

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

GHSA-hpcc-26xq-25fv CVE-2026-56816 HIGH 5 days ago

### Summary Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload length without any limits. Th...

maven

No PRs yet

Netty: Security Control Bypass via CORS Short-Circuit Failure

GHSA-6cqp-g7gg-8hr5 CVE-2026-56746 MODERATE 5 days ago

### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests immediately, acting...

maven

No PRs yet

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

GHSA-jppx-w49h-x2qq CVE-2026-56745 HIGH 5 days ago

The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with...

maven

No PRs yet

Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

GHSA-q6cq-mhr2-jmr5 CVE-2026-55851 HIGH 5 days ago

The `HAProxyMessageDecoder` in netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte of the inbound stream as...

maven

No PRs yet

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

GHSA-mvh2-crg5-v77c CVE-2026-55833 HIGH 5 days ago

### Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeader...

maven

No PRs yet

Netty SPDY SETTINGS frame count materializes unbounded settings map

GHSA-6jqx-86gh-f27w CVE-2026-55831 HIGH 5 days ago

### Summary Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every u...

maven

No PRs yet

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

GHSA-5gvw-p9qm-jgwh CVE-2026-59889 MODERATE 6 days ago

## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and ...

maven

No PRs yet

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

GHSA-r7wm-3cxj-wff9 HIGH 6 days ago

## Summary The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/adv...

maven

No PRs yet

jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

GHSA-mhm7-754m-9p8w MODERATE 6 days ago

## Summary In `BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId`, the active-view (`@JsonView`) filter was applied only to the reg...

maven

No PRs yet

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

GHSA-3pjw-73gf-8qr5 CVE-2026-59888 MODERATE 6 days ago

## Summary For Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original imp...

maven

No PRs yet

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

GHSA-j92g-9f8w-j867 CVE-2026-54291 HIGH 6 days ago

### Impact `channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-25...

maven

1

Dependabot PRs

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

GHSA-mhww-p97m-3368 CVE-2026-11400 HIGH 10 days ago

Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issu...

maven

No PRs yet

ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

GHSA-x8mg-6r4p-87pf HIGH 11 days ago

About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the en...

maven

No PRs yet

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

GHSA-vwjc-v7x7-cm6g HIGH 11 days ago

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabase(UPDATE_SECURITY) gate on the polyglot engine (PolyglotQueryEngine.java:112-114...

maven

1

Dependabot PRs

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

GHSA-x9f9-r4m8-9xc2 HIGH 11 days ago

ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation ...

maven

No PRs yet

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

GHSA-48qw-824m-86pr HIGH 11 days ago

### Impact A user holding only `reader` (read-only) privileges on a single database could execute arbitrary JVM code by sending a `"language": "js...

maven

No PRs yet

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

GHSA-vg6x-6pg9-6qwg CVE-2026-54076 HIGH 11 days ago

### Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single schema-mutating method (`Loca...

maven

No PRs yet

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

GHSA-8w86-m9h8-hvqg CVE-2026-54077 HIGH 11 days ago

### Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validat...

maven

No PRs yet

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

GHSA-74xj-wh4w-vqxc CVE-2026-50270 HIGH 12 days ago

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byt...

maven

No PRs yet

Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

GHSA-vhch-2wf3-m8rp CVE-2026-44891 HIGH 13 days ago

### Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause a...

maven

No PRs yet