The Gradle Shadow plugin's ShadowCopyAction does not sanitize ZIP entry names before including them in the output fat JAR, allowing path traversal entries to be reproduced verbatim. This vulnerability affects versions prior to 9.6.0. Malicious dependencies with crafted ZIP entries can cause arbitrary file overwrite when the shadow JAR is extracted by downstream tools that do not protect against Zip Slip attacks.
JSON-java (org.json:json) versions prior to 20260719 contain a denial-of-service vulnerability due to unbounded numeric string parsing. The JSONTokener.nextSimpleValue() method accumulates numeric characters without length limits, passing large numeric strings to BigInteger or BigDecimal constructors, which have polynomial time complexity. This can cause significant CPU consumption and thread blocking when processing large numeric literals in JSON input. The vulnerability affects all primary JSON parsing entry points and is not mitigated by existing configuration options. A fix is available in version 20260719.
A vulnerability in zt-zip's ZipUtil.unpack method allows a ZIP entry named as the output directory itself (e.g., '/') to cause unintended changes to the directory's file permissions. This can result in the output directory becoming accessible to all OS users instead of just the owner. The issue affects versions prior to 1.18.1 and is relevant on POSIX-compliant systems and others using fallback permission strategies.
A path traversal vulnerability exists in the org.zeroturnaround:zt-zip library's fluent API unpack method (CVE-2026-63436). The Zips fluent API does not properly validate ZIP entry paths, allowing entries with '../' sequences to write files outside the intended extraction directory. This can lead to arbitrary file writes outside the target directory when unpacking attacker-controlled ZIP files. The issue affects versions prior to 1.18.0 and is fixed in version 1.18.0.
A privilege escalation vulnerability exists in Eclipse hawkBit Direct Device Integration (DDI) Controller versions 1.0.3 and earlier. Authenticated devices within a tenant can bypass assignment restrictions and download any firmware artifact assigned to that tenant, rather than only those explicitly assigned to them. This flaw is due to improper object-level authorization validation. The vulnerability has moderate severity with low confidentiality impact, as access is limited to the tenant scope and firmware binaries typically do not contain sensitive data. The issue is fixed in version 1.0.4.
A JWT algorithm confusion vulnerability in Keycloak's JWT Authorization Grant flow allows attackers with valid client credentials to bypass signature verification. This flaw enables forging assertions to create unauthorized access tokens, permitting impersonation of any federated user linked to the affected Identity Provider. The vulnerability affects Keycloak versions prior to 26.6.4 and has been assigned CVE-2026-11800 with a high severity rating. A patch is available in version 26.6.4.
MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 contain a vulnerability where a rogue or MitM server can cause the client to allocate large amounts of heap memory based on server-declared lengths in OK packets. This can lead to excessive garbage collection pressure and potentially an OutOfMemoryError, impacting availability. The flaw arises because the client allocates memory before validating that the declared lengths fit within the actual packet size. The issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions prior to 3.3.7, 3.4.5, and 3.5.10 improperly handle 8-byte length-encoded integers by truncating values larger than Integer.MAX_VALUE to a signed int without validation. This can cause negative or arbitrary lengths leading to client crashes or oversized memory allocations when interacting with a malicious or compromised server. The vulnerability impacts availability only and requires control over the server side. No confidentiality, integrity, or authentication bypass issues are involved. Fixed versions are available.
MariaDB Connector/J versions 3.0.0 through before 3.3.7, 3.4.0 through before 3.4.5, and 3.5.0 through before 3.5.11 contain a vulnerability in the XAResource.recover() method. The method trusts server-supplied gtrid_length and bqual_length values without validating them against XA specification bounds, leading to potential large memory allocations or exceptions during XA recovery. This can cause availability issues such as crashes or denial of service. Exploitation requires control over the server side of the connection. Fixed versions are 3.3.7, 3.4.5, and 3.5.11.
MariaDB Connector/J versions before 3.3.7, 3.4.5, and 3.5.11 improperly validate LOAD DATA LOCAL INFILE file requests by searching for the file name text anywhere in the SQL command, including inside quoted identifiers and comments. This flaw allows a malicious or compromised server, or a man-in-the-middle, to trick the client into sending arbitrary local files readable by the JVM to the server. The vulnerability affects standard JDBC calls such as DatabaseMetaData.getImportedKeys() and getExportedKeys(). A fix is available that properly parses the SQL command to validate the file request.
MariaDB Connector/J versions 3.0.0 through before 3.3.7, 3.4.0 through before 3.4.5, and 3.5.0 through before 3.5.11 have a vulnerability where the connector does not properly guard against changes to the character_set_results session variable. This allows a malicious or compromised server to switch the character set away from UTF-8 without the client noticing, causing incorrect decoding of query results. This can lead to integrity issues where application-side validation or escaping based on string values can be bypassed. The vulnerability requires control of the server side of the connection and does not impact confidentiality or availability. Fixed versions are 3.3.7, 3.4.5, and 3.5.11.
The NationalSecurityAgency/emissary package contains a vulnerability in its URL validation logic within NavAction.java. The regex intended to restrict URLs allows protocol-relative URLs (e.g., //evil.com) and single-slash scheme variants (e.g., http:/evil.com) to bypass validation. This flaw enables server-side request forgery (SSRF) and open redirect attacks. The vulnerability affects versions prior to 8.51.0, which includes the commit e2078417464b that introduced the flawed regex. The issue is rated medium severity with a CVSS score of 4.8.
Keycloak versions prior to 26.6.4 contain a cross-site scripting (XSS) vulnerability that allows a remote attacker with administrative privileges and specific permissions to bypass client URI validation. This is done by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. The vulnerability enables arbitrary code execution in the Keycloak origin when a victim interacts with crafted links, such as during logout or in the Admin Console. A fix is available in version 26.6.4.
A vulnerability in Keycloak allows a realm administrator with the "manage-realm" role to disclose information by submitting arbitrary filesystem paths as keystore parameters when creating a key provider component. This flaw enables probing of filesystem paths to determine file existence and readability by the Keycloak process, potentially aiding further attacks. The issue affects Keycloak versions prior to 26.6.4. A fix is available in version 26.6.4.
A vulnerability in org.keycloak:keycloak-services allows an authenticated user with a User-Managed Access (UMA) permission ticket for one resource to bypass per-resource access controls and gain unauthorized access to all resources of that type within the same resource server. This issue occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled without explicit policies protecting the resource type. The vulnerability can lead to unauthorized information disclosure or modification of resources. A fix is available in version 26.6.4.
A vulnerability in Keycloak Policy Enforcer allows any authenticated user to bypass all authorization policies, including role, scope, and UMA permission checks. This occurs when an attacker includes the configured access-denied page path within a request URL, either as a path segment or a query parameter, enabling unauthorized access to protected resources. The flaw affects Keycloak versions prior to 26.6.4 and 26.0.10. A fix is available in these versions.
A vulnerability in Keycloak's client registration service allows an attacker with a previously issued Registration Access Token (RAT) to re-enable clients that an administrator has disabled. This enables the attacker to reset the client's secret and potentially regain privileged API access, leading to unauthorized information disclosure and integrity compromise. The issue affects versions prior to 26.6.4 and has been assigned CVE-2026-9705 with a CVSS score of 6.5 (medium severity). A patch is available in version 26.6.4.
OpenTelemetry Java's W3C trace-context propagator has a vulnerability that allows crafted tracestate headers to cause excessive CPU consumption due to quadratic regex backtracking. This can lead to denial of service by blocking the parsing thread. The issue affects versions prior to 1.67.0 and is fixed in version 1.67.0. Mitigation includes upgrading to 1.67.0 or later or rejecting oversized tracestate headers before extraction.
A heap buffer overflow vulnerability exists in the Snappy.uncompress*Array typed-array methods of snappy-java before version 1.1.10.9. The issue arises because the methods size the result array by dividing the declared uncompressed byte length by the element size, but native code writes the full byte length, potentially writing up to 7 bytes past the end of the Java array if the length is not a multiple of the element size. This heap corruption can lead to application instability or crashes. The vulnerability is fixed in version 1.1.10.9, where the methods now reject uncompressed lengths that are not multiples of the element size by throwing a SnappyIOException. Users can mitigate by verifying the uncompressed length is a multiple of the element size before calling these methods.
A vulnerability in snappy-java prior to version 1.1.10.9 allows JVM crashes due to unchecked array range parameters in Snappy.arrayCopy and related stream read/write methods. The flaw arises from native memcpy calls without validating offsets and lengths, leading to out-of-bounds memory access and JVM crashes. This issue has been fixed in version 1.1.10.9 by adding proper range checks.