A vulnerability in tools.jackson.core:jackson-core affects its asynchronous JSON parser's handling of streamed numeric input. The issue is an incomplete fix for a prior CVE, allowing an attacker to bypass the maxNumberLength constraint by streaming JSON numbers in many small chunks without terminators. This causes excessive memory allocation, potentially exhausting JVM heap memory. The flaw impacts versions from 2.15.0 through 2.18.7, 2.19.0 through 2.21.3, 2.22.0, and 3.0.0 through 3.1.3 and 3.2.0. Synchronous parsers and async parsers on complete input are not affected. Exploitation requires only the ability to stream data to a parsing endpoint, with no privileges or user interaction needed.
CVE-2026-8763 is a critical vulnerability in Bouncy Castle for Java before versions 1.85, 2.73.12, and specific FIPS releases. It allows bypassing Name Constraints validation via a trailing dot in rfc822Name and URI fields. This flaw affects multiple Bouncy Castle Java variants and has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity without requiring privileges or user interaction.
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
A vulnerability in Netty's HTTP/2 codec allows a remote unauthenticated attacker to cause a denial of service by leaking direct ByteBuf memory. This occurs when HTTP/2 content decompression is enabled and a DATA frame is processed for a stream whose decompressor channel is already closed. The decompressor retains the frame buffer without releasing it, causing direct memory exhaustion and JVM crashes due to OutOfMemoryError. The issue affects specific Netty versions prior to 4.2.16.Final and 4.1.136.Final and has a high severity rating.
Multiple vulnerabilities exist in OmniFaces related to forged combined-resource IDs, unbounded caches, cross-site scripting via hashParam, session push-channel replay, and push idle-connection handling. Forged combined-resource IDs allow attackers to inflate resource usage and bypass resource boundaries. The source-map cache can grow unboundedly. The hashParam component can lead to JavaScript injection in Ajax callbacks. Session push channels are not properly bound to HTTP sessions, enabling replay of push messages. Push channel idle timeouts and client fanout lack proper limits. These issues affect multiple OmniFaces versions prior to fixed releases.
The http4s-blaze-server aggregates incoming WebSocket message fragments without limiting total size or fragment count. An attacker completing a WebSocket handshake can send an unterminated fragmented message, causing unbounded heap growth in the server JVM and resulting in denial of service via OutOfMemoryError. This affects any http4s application using BlazeServerBuilder for WebSocket routes with versions prior to 0.23.18. No default configuration limits the aggregate buffer size, and the maxWebSocketBufferSize setting only limits individual frames. Mitigation involves limiting or terminating WebSocket traffic at a fronting layer or migrating to a maintained backend, as blaze-server is end-of-life upstream.
A vulnerability in org.http4s blaze-server allows HTTP/1.1 chunked-body trailer fields to be merged into Request.headers. This enables an unauthenticated remote attacker to inject arbitrary HTTP headers that may bypass fronting proxy sanitization. Applications trusting proxy-set headers such as X-Forwarded-For or internal authentication headers are at risk of spoofing client IPs, forging HTTPS schemes, or injecting unauthorized headers. The vulnerability also allows attacker-controlled termination of pooled backend connections via a promoted Connection: close trailer. Workarounds include deploying behind proxies that remove or reject trailer fields and avoiding trust decisions based on proxy-sanitized headers until patched.
Multiple HTTP/1.1 request-smuggling vulnerabilities exist in the blaze server's Java wire parser used by org.http4s:http4s-blaze-server_2.13. These parser laxities cause disagreement on request boundaries when paired with stricter intermediaries, potentially allowing bypass of front-end access controls, response queue poisoning, and cache poisoning. The vulnerabilities affect versions prior to 0.23.18. Exploitability depends on the presence of a fronting proxy that interprets requests differently. Deploying behind an RFC-compliant reverse proxy can mitigate the risk until an upgrade is possible.
A vulnerability in OpenDJ server legacy versions prior to 5.1.2 allows an attacker with the proxied-auth privilege to bypass proxy access control checks when using SASL PLAIN authentication with an authorization identity (authzid). This flaw permits privilege escalation by impersonating arbitrary non-root directory users beyond the intended proxy ACI restrictions. The issue arises because the SASL PLAIN authzid path does not enforce the mayProxy scope check, unlike other proxy paths. The vulnerability is critical and can be mitigated by upgrading to version 5.1.2 or later or restricting the proxied-auth privilege until patched.
OpenDJ DSMLv2 SOAP gateway versions prior to 5.1.2 allow unauthenticated remote attackers to perform server-side request forgery (SSRF), local file reads, and unbounded memory consumption leading to denial of service (DoS). This is due to dereferencing attacker-supplied anyURI values without proper allowlisting, egress filtering, or size limits. The vulnerability is fixed in version 5.1.2 by disabling anyURI dereferencing by default, enforcing an http/https allowlist, blocking loopback and private addresses, refusing redirects, capping read sizes, and requiring authentication by default.
OpenAM versions up to 16.1.1 contain a critical unauthenticated remote code execution vulnerability via the /authservice endpoint. The vulnerability arises because the server loads and instantiates arbitrary Java classes named in a <CustomCallback> XML element without validation. This allows attackers to execute code on the server without authentication. The issue is fixed in version 16.1.2.
Netty's XmlFrameDecoder component has a vulnerability that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) via CPU exhaustion. The flaw arises when the decoder processes malicious XML payloads containing repeated '</' sequences, causing the server's EventLoop thread to become unresponsive due to excessive CPU usage. This affects applications using vulnerable versions of Netty's XML codec.
A memory leak vulnerability exists in Netty's DNS codec due to improper handling of malformed domain names. When invalid domain names cause exceptions during DNS record decoding, allocated buffers are not released, leading to incremental memory leaks. Sustained exploitation can cause resource exhaustion and denial of service in applications using Netty's DnsRecordDecoder.
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
A vulnerability in Eclipse Jetty's DigestAuthentication.apply() method causes authentication bypass due to lossy ISO-8859-1 encoding of passwords containing non-Latin-1 characters. The method replaces all characters outside the ISO-8859-1 range with '?', resulting in identical MD5 digest hashes for different passwords. This allows attackers to authenticate using a collision password with substituted '?' characters. Additionally, legitimate users with non-Latin-1 characters in their passwords cannot authenticate, causing denial of service. The issue affects multiple Jetty versions prior to fixed releases and has a high severity score.
CVE-2026-59921 is a CRLF injection vulnerability in Netty's HttpPostRequestEncoder affecting versions prior to 4.2.16.Final and 4.1.136.Final. The vulnerability arises because user-controlled filenames are directly embedded into multipart Content-Disposition headers without sanitization of CRLF characters. This allows attackers to inject arbitrary MIME headers, potentially leading to MIME header injection, content-type spoofing, and cross-site scripting (XSS) attacks. The flaw requires low privileges but no user interaction and has a high impact on confidentiality and integrity.
CVE-2026-59920 is a medium severity vulnerability in Netty's STOMP codec encoder affecting versions prior to 4.2.16.Final and 4.1.136.Final. The flaw arises because the encoder skips escaping newline characters in CONNECT and CONNECTED frame headers, allowing injection of additional STOMP headers. This improper neutralization of CRLF sequences can lead to header injection and potential authentication bypass. The vulnerability requires low privileges and no user interaction but depends on the application placing user-controlled input into CONNECT frame headers without sanitization. A fix is available in versions 4.2.16.Final and 4.1.136.Final.
Netty versions prior to 4.2.16.Final and 4.1.136.Final with the codec-haproxy component contain a vulnerability in the HAProxy V1 protocol encoder. The encoder writes AF_UNIX socket addresses directly into the PROXY protocol header without validating for CRLF characters. This allows an attacker to inject additional PROXY protocol lines, potentially enabling client IP spoofing. The vulnerability arises because AF_UNIX addresses are only length-checked, unlike IPv4/IPv6 addresses which are format-validated to block CRLF. A crafted AF_UNIX address containing CRLF can split the PROXY header into multiple lines, misleading downstream servers or load balancers about the true client IP. A fix is available in Netty versions 4.2.16.Final and 4.1.136.Final.
Netty's Bzip2Decoder handler contains a vulnerability in its run-length encoding state machine that can cause an infinite loop when processing a malformed bzip2 stream. This results in the event-loop thread hanging, leading to a denial-of-service condition. The flaw affects versions prior to 4.2.16.Final and 4.1.136.Final and has a high severity rating with a CVSS score of 8.7. Fixed versions are available.
Netty's HTTP/2-to-HTTP/1.x translation layer improperly handles Host headers when both the :authority pseudo-header and a literal Host header are present in the same HTTP/2 HEADERS frame. This results in an HttpRequest object containing two Host headers with differing attacker-controlled values, potentially allowing request routing bypass.