CVE-2026-12860VulnerabilityPublished 21 Sep 2026Updated 29 Oct 2026

Red Hat Security Advisory: Red Hat build of Quarkus 3.33.3.SP2 release and security update

Affects Red HatSource GCVE Database

Compare

Mentioned vulnerabilities

Authoritative record:CVE-2026-12860· High 8.7

Not known to be exploited · CVSS 8.7 High · fixed in Red Hat package updates : patch Red Hat bcprov soon.

Data as of 29 Oct 2026, 22:46 UTC

CVSS 4.0 base score

8.7High

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 1.85, 2.73.12

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

Base metrics

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: High
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Supplemental metrics

Provider Urgency: Amber

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the vulnerable system. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the vulnerable system.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.
Provider Urgency: Amber: Provider has assessed the impact of this vulnerability as having a moderate urgency.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade BC-JAVA and Legion of the Bouncy Castle Inc./bcprov to 1.85; BC-LTS-JAVA and Legion of the Bouncy Castle Inc./bcprov-lts8on to 2.73.12.

Affected software

Product	Affected	Fixed in
Legion of the Bouncy Castle Inc.BC-JAVA	Affected <1.85	Fixed in 1.85
Legion of the Bouncy Castle Inc.BC-LTS-JAVA	Affected >=2.73.0 <2.73.12	Fixed in 2.73.12
MavenLegion of the Bouncy Castle Inc./bcprov`pkg:maven/Legion of the Bouncy Castle Inc./bcprov`Other threats	Affected <1.85	Fixed in 1.85
MavenLegion of the Bouncy Castle Inc./bcprov-lts8on`pkg:maven/Legion of the Bouncy Castle Inc./bcprov-lts8on`Other threats	Affected >=2.73.0 <2.73.12	Fixed in 2.73.12

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

This release of Red Hat build of Quarkus 3.33.3.SP2 includes security updates, bug fixes and enhancements. For more information, see the release notes page listed in the References section. Security Fix(es): * hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass [quarkus-3.33] (CVE-2026-77874) * jsoup: Cross-site scripting flaw requires a custom Safelist that explicitly allows raw-text elements [quarkus-3.33] (CVE-2026-71497) * wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [quarkus-3.33] (CVE-2026-19611) * quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver [quarkus-3.33] (CVE-2026-81829) * jsoup: jsoup: Denial of Service via deeply nested XML documents [quarkus-3.33] (CVE-2026-75140) * reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure [quarkus-3.33] (CVE-2026-47857) * reactor-core: Reactor Core: Denial of Service in bufferTimeout operator [quarkus-3.33] (CVE-2026-47863) * quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security [quarkus-3.33] (CVE-2026-87743) * quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering [quarkus-3.33] (CVE-2026-87742) * zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [quarkus-3.33] (CVE-2026-87825) * zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [quarkus-3.33] (CVE-2026-87877) * zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [quarkus-3.33] (CVE-2026-87795) * zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [quarkus-3.33] (CVE-2026-87824) * zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [quarkus-3.33] (CVE-2026-89046) * zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [quarkus-3.33] (CVE-2026-90560) * bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names [quarkus-3.33] (CVE-2026-58059) * bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification [quarkus-3.33] (CVE-2026-12860) * zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [quarkus-3.33] (CVE-2026-90852) * zstd-jni: zstd-jni: Denial of Service via negative length parameter [quarkus-3.33] (CVE-2026-89045) * zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read [quarkus-3.33] (CVE-2026-87823) * netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams [quarkus-3.33] (CVE-2026-93488) * netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue [quarkus-3.33] (CVE-2026-93491) * netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service [quarkus-3.33] (CVE-2026-93558) * netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) [quarkus-3.33] (CVE-2026-93564) * netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte [quarkus-3.33] (CVE-2026-93565) * netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [quarkus-3.33] (CVE-2026-93567) * netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [quarkus-3.33] (CVE-2026-93568) * netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [quarkus-3.33] (CVE-2026-93569) * netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [quarkus-3.33] (CVE-2026-93492) * netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling [quarkus-3.33] (CVE-2026-93562) * netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line [quarkus-3.33] (CVE-2026-93566) * netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling [quarkus-3.33] (CVE-2026-93573) * netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing [quarkus-3.33] (CVE-2026-93574) * netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [quarkus-3.33] (CVE-2026-93579) For more information, see the release notes page listed in the References section.

CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
OWASP Cheat Sheets
XML Security (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
REST Assessment (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.2 (opens in a new tab)
V3.5.3 (opens in a new tab)
V13.2.6 (opens in a new tab)
Attack patterns
Padding Oracle Crypto Attack (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-173Improper Handling of Alternate Encoding (opens in a new tab)
Variant weakness
The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
Architecture and Design · Input Validation
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8.
OWASP Cheat Sheets
Content Security Policy (opens in a new tab)
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
OWASP ASVS 4.0.3
V14.4.1 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Double Encoding (opens in a new tab)
Leverage Alternate Encoding (opens in a new tab)
Using Leading 'Ghost' Character Sequences to Bypass Input Filters (opens in a new tab)
Using Alternative IP Address Encodings (opens in a new tab)
Embedding NULL Bytes (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
Regular Expression Exponential Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)
Base weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-89Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #2OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Parameterization
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
OWASP Cheat Sheets
Query Parameterization (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V5.3.4 (opens in a new tab)
V5.3.5 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Command Line Execution through SQL Injection (opens in a new tab)
Object Relational Mapping Injection (opens in a new tab)
SQL Injection through SOAP Parameter Tampering (opens in a new tab)
Expanding Control over the Operating System from the Database (opens in a new tab)
SQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-22Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.1 (opens in a new tab)
Attack patterns
Path Traversal (opens in a new tab)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
Using Escaped Slashes in Alternate Encoding (opens in a new tab)
Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (opens in a new tab)
Base weakness
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Architecture and Design
URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice.
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overread Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-825Expired Pointer Dereference (opens in a new tab)
Base weakness
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Architecture and Design
Choose a language that provides automatic memory management.
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Architecture and Design · Language Selection
Choose a language that provides automatic memory management.
Implementation · Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-835Loop with Unreachable Exit Condition (Infinite Loop) (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-1035OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities (opens in a new tab)
CategoryOWASP Top 10 A03:2025: Software Supply Chain Failures (opens in a new tab)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
MITRE does not allow mapping vulnerabilities to this entry; it groups weaknesses rather than naming one.
OWASP Cheat Sheets
OWASP Cheat Sheet Series: Dependency Graph SBOM (opens in a new tab)
OWASP Cheat Sheet Series: Vulnerable Dependency Management (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Attack Surface Reduction
Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of…
Architecture and Design · Libraries or Frameworks
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Buffer Overflow via Environment Variables (opens in a new tab)
Server Side Include (SSI) Injection (opens in a new tab)
Cross Zone Scripting (opens in a new tab)
Command Line Execution through SQL Injection (opens in a new tab)
Object Relational Mapping Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-444Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache.
Implementation
Use only SSL communication.
Implementation
Terminate the client session after each request.
OWASP Cheat Sheets
REST Assessment (opens in a new tab)
REST Security (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V13.2.5 (opens in a new tab)
Attack patterns
HTTP Response Smuggling (opens in a new tab)
HTTP Request Smuggling (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

GCVE source: db.gcve.eu
Csaf Category: csaf_security_advisory
Csaf Version: 2.0
Publisher: Red Hat Product Security
Advisory ID: RHSA-2026:69440
Vendor Severity: high
CVE Count: 34
Additional Cves: CVE-2026-19611, CVE-2026-47857, CVE-2026-47863, CVE-2026-58059, CVE-2026-71497, CVE-2026-75140, CVE-2026-77874, CVE-2026-81829, CVE-2026-87742, CVE-2026-87743, CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877, CVE-2026-89045, CVE-2026-89046, CVE-2026-90560, CVE-2026-90852, CVE-2026-93488, CVE-2026-93491, CVE-2026-93492, CVE-2026-93558, CVE-2026-93562, CVE-2026-93564, CVE-2026-93565, CVE-2026-93566, CVE-2026-93567, CVE-2026-93568, CVE-2026-93569, CVE-2026-93573, CVE-2026-93574, CVE-2026-93579

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

WeaknessesCWE-347, CWE-173, CWE-770 +13

Technical details

References

Community reviews

Related threats