{"grype_matches":[{"artifact":{"id":"e923fcaa7efff8e3","cpes":["cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.osgi.PGBundleActivator:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql-global-development-group:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql_global_development_group:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql.jdbc:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle-corporation:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle_corporation:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:PGBundleActivator:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:PGBundleActivator:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:org.postgresql:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:postgresql:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jdbc:osgi:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:jdbc:42.7.2:*:*:*:*:*:*:*","cpe:2.3:a:osgi:osgi:42.7.2:*:*:*:*:*:*:*"],"name":"postgresql","purl":"pkg:maven/org.postgresql/postgresql@42.7.2","type":"java-archive","version":"42.7.2","language":"java","licenses":["BSD-2-Clause"],"metadata":{"pomGroupID":"org.postgresql","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/postgresql-42.7.2.jar","manifestName":"","pomArtifactID":"postgresql","archiveDigests":[{"value":"86ed42574cd68662b05d3b00432a34e9a34cb12c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/postgresql-42.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"42.7.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98qh-xjc8-98pq","versionConstraint":">=42.2.0,<42.7.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.postgresql:postgresql","version":"42.7.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98qh-xjc8-98pq","fix":{"state":"fixed","versions":["42.7.11"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"42.7.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42198","date":"2026-10-27","epss":0.03261,"percentile":0.88308}],"risk":2.44575,"urls":["https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","https://nvd.nist.gov/vuln/detail/CVE-2026-42198","https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98qh-xjc8-98pq","description":"pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42198","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42198","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42198","date":"2026-10-27","epss":0.03261,"percentile":0.88308}],"urls":["https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11","https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq","https://access.redhat.com/errata/RHSA-2026:19098","https://access.redhat.com/errata/RHSA-2026:22304","https://access.redhat.com/errata/RHSA-2026:24348","https://access.redhat.com/errata/RHSA-2026:25030","https://access.redhat.com/errata/RHSA-2026:52928","https://access.redhat.com/errata/RHSA-2026:52929","https://access.redhat.com/errata/RHSA-2026:52930","https://access.redhat.com/errata/RHSA-2026:52978","https://access.redhat.com/errata/RHSA-2026:54532","https://access.redhat.com/errata/RHSA-2026:59277","https://access.redhat.com/errata/RHSA-2026:59278","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42198","https://bugzilla.redhat.com/show_bug.cgi?id=2463857","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42198","description":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11."}]},{"artifact":{"id":"c658aadea4606171","cpes":["cpe:2.3:a:apache:commons-io:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_io:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.8.0:*:*:*:*:*:*:*"],"name":"commons-io","purl":"pkg:maven/commons-io/commons-io@2.8.0","type":"java-archive","version":"2.8.0","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-io","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/velocity-engine-core-2.3.jar:commons-io:commons-io","manifestName":"","pomArtifactID":"commons-io","archiveDigests":null},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/velocity-engine-core-2.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.14.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-78wr-2p64-hpwj","versionConstraint":">=2.0,<2.14.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-io:commons-io","version":"2.8.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-78wr-2p64-hpwj","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2024-10-04","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47554","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47554","date":"2026-10-27","epss":0.01315,"percentile":0.70594}],"risk":1.0257,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-47554","https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","http://www.openwall.com/lists/oss-security/2024/10/03/2","https://security.netapp.com/advisory/ntap-20250131-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-78wr-2p64-hpwj","description":"Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader"},"relatedVulnerabilities":[{"id":"CVE-2024-47554","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47554","cwe":"CWE-400","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47554","date":"2026-10-27","epss":0.01315,"percentile":0.70594}],"urls":["https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","http://www.openwall.com/lists/oss-security/2024/10/03/2","https://security.netapp.com/advisory/ntap-20250131-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47554","description":"Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rmj7-2vxq-3g9f","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rmj7-2vxq-3g9f","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-27","epss":0.01226,"percentile":0.68674}],"risk":0.95628,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://nvd.nist.gov/vuln/detail/CVE-2026-54513","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","description":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)"},"relatedVulnerabilities":[{"id":"CVE-2026-54513","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54513","cwe":"CWE-184","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54513","date":"2026-10-27","epss":0.01226,"percentile":0.68674}],"urls":["https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","https://github.com/FasterXML/jackson-databind/issues/5981","https://github.com/FasterXML/jackson-databind/issues/5983","https://github.com/FasterXML/jackson-databind/pull/5984","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","https://access.redhat.com/errata/RHSA-2026:36839","https://access.redhat.com/errata/RHSA-2026:40895","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:43218","https://access.redhat.com/errata/RHSA-2026:43400","https://access.redhat.com/errata/RHSA-2026:44061","https://access.redhat.com/errata/RHSA-2026:44062","https://access.redhat.com/errata/RHSA-2026:44063","https://access.redhat.com/errata/RHSA-2026:44064","https://access.redhat.com/errata/RHSA-2026:44065","https://access.redhat.com/errata/RHSA-2026:44066","https://access.redhat.com/errata/RHSA-2026:44271","https://access.redhat.com/errata/RHSA-2026:48095","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50846","https://access.redhat.com/errata/RHSA-2026:50847","https://access.redhat.com/errata/RHSA-2026:50848","https://access.redhat.com/errata/RHSA-2026:50849","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54622","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-54513","https://bugzilla.redhat.com/show_bug.cgi?id=2492010","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"c549712d19d83e7a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"730b1c0df761ecae4de489b974efe29135d996f5","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3qp7-7mw8-wx86","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3qp7-7mw8-wx86","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-10-27","epss":0.00987,"percentile":0.62239}],"risk":0.7698600000000001,"urls":["https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-44249"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","description":"Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking"},"relatedVulnerabilities":[{"id":"CVE-2026-44249","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44249","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-697","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44249","cwe":"CWE-1287","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44249","date":"2026-10-27","epss":0.00987,"percentile":0.62239}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44249","https://bugzilla.redhat.com/show_bug.cgi?id=2488081","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","description":"Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"530dea1634359c07","cpes":["cpe:2.3:a:io.netty.codec-dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_dns:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-dns","purl":"pkg:maven/io.netty/netty-codec-dns@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-dns","archiveDigests":[{"value":"693b6a173f4e510c00d784f80d309c25ba547aaa","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cm33-6792-r9fm","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-dns","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cm33-6792-r9fm","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-10-27","epss":0.01006,"percentile":0.62844}],"risk":0.7545,"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://tools.ietf.org/html/rfc1035#section-2.3.4","https://tools.ietf.org/html/rfc1035#section-4.1.4","https://nvd.nist.gov/vuln/detail/CVE-2026-42579"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cm33-6792-r9fm","description":"Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)"},"relatedVulnerabilities":[{"id":"CVE-2026-42579","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42579","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-626","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42579","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42579","date":"2026-10-27","epss":0.01006,"percentile":0.62844}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-42579","https://bugzilla.redhat.com/show_bug.cgi?id=2477217","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42579","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-27","epss":0.0099,"percentile":0.62344}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-27","epss":0.0099,"percentile":0.62344}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"1f4e62e797862c40","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"ce03862f1ce5e4bd5a8af688ac9f5146a8192867","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f6hv-jmp6-3vwv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f6hv-jmp6-3vwv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-27","epss":0.0099,"percentile":0.62344}],"risk":0.7425000000000002,"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://nvd.nist.gov/vuln/detail/CVE-2026-42587"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","description":"Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-42587","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42587","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42587","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42587","date":"2026-10-27","epss":0.0099,"percentile":0.62344}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42587","https://bugzilla.redhat.com/show_bug.cgi?id=2477220","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3rv-43j4-c7qm","versionConstraint":">=2.19.0,<=2.21.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-j3rv-43j4-c7qm","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-27","epss":0.00944,"percentile":0.60878}],"risk":0.7363200000000001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://nvd.nist.gov/vuln/detail/CVE-2026-54512"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","description":"jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation"},"relatedVulnerabilities":[{"id":"CVE-2026-54512","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54512","cwe":"CWE-184","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-54512","cwe":"CWE-502","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54512","date":"2026-10-27","epss":0.00944,"percentile":0.60878}],"urls":["https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","https://github.com/FasterXML/jackson-databind/issues/5988","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"c549712d19d83e7a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"730b1c0df761ecae4de489b974efe29135d996f5","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x4gw-5cx5-pgmh","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x4gw-5cx5-pgmh","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-10-27","epss":0.00921,"percentile":0.60124}],"risk":0.69075,"urls":["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45416"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","description":"Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes"},"relatedVulnerabilities":[{"id":"CVE-2026-45416","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45416","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45416","date":"2026-10-27","epss":0.00921,"percentile":0.60124}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-45416","https://bugzilla.redhat.com/show_bug.cgi?id=2488391","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"a3969d328aaf008f","cpes":["cpe:2.3:a:bouncycastle-org:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg-jdk15to18:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg-jdk15to18:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg_jdk15to18:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg_jdk15to18:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg:bcpg-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpg:bcpg_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcpg-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcpg-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcpg-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcpg-jdk15to18","archiveDigests":[{"value":"3cf0703481e16bbf576fb393f8680848f72c628e","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcpg-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cj8j-37rh-8475","versionConstraint":"<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpg-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cj8j-37rh-8475","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3505","cwe":"CWE-400","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3505","date":"2026-10-27","epss":0.00787,"percentile":0.55944}],"risk":0.63747,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-3505","https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cj8j-37rh-8475","description":"Bouncy Castle Uncontrolled Resource Consumption vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-3505","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3505","cwe":"CWE-400","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-3505","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-3505","date":"2026-10-27","epss":0.00787,"percentile":0.55944}],"urls":["https://github.com/bcgit/bc-java/commit/dc7530939ffb6cdb57636f3609d98e23b94e71c1","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/security/cve/CVE-2026-3505","https://bugzilla.redhat.com/show_bug.cgi?id=2458638","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3505.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3505","description":"Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).\n\n This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57rv-r2g8-2cj3","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57rv-r2g8-2cj3","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-10-27","epss":0.00838,"percentile":0.57578}],"risk":0.62012,"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://nvd.nist.gov/vuln/detail/CVE-2026-42584"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","description":"Netty has HttpClientCodec response desynchronization"},"relatedVulnerabilities":[{"id":"CVE-2026-42584","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42584","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42584","date":"2026-10-27","epss":0.00838,"percentile":0.57578}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42584","https://bugzilla.redhat.com/show_bug.cgi?id=2477224","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"d4b1f4f889e3761d","cpes":["cpe:2.3:a:org.codehaus.plexus:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.plexus:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.plexus:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus-utils:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus-utils:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus_utils:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus_utils:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus-utils:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus:plexus-utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus:plexus_utils:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus_utils:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:plexus:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:plexus:plexus:3.5.1:*:*:*:*:*:*:*"],"name":"plexus-utils","purl":"pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1","type":"java-archive","version":"3.5.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.codehaus.plexus","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/plexus-utils-3.5.1.jar","manifestName":"","pomArtifactID":"plexus-utils","archiveDigests":[{"value":"c6bfb17c97ecc8863e88778ea301be742c62b06d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/plexus-utils-3.5.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.6.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6fmv-xxpf-w3cw","versionConstraint":"<3.6.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.codehaus.plexus:plexus-utils","version":"3.5.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6fmv-xxpf-w3cw","fix":{"state":"fixed","versions":["3.6.1"],"available":[{"date":"2026-04-09","kind":"first-observed","version":"3.6.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-67030","date":"2026-10-27","epss":0.00689,"percentile":0.52546}],"risk":0.51675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-67030","https://github.com/codehaus-plexus/plexus-utils/issues/294","https://github.com/codehaus-plexus/plexus-utils/pull/295","https://github.com/codehaus-plexus/plexus-utils/pull/296","https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642","https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec","https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6fmv-xxpf-w3cw","description":"Plexus-Utils has a Directory Traversal vulnerability in its extractFile method"},"relatedVulnerabilities":[{"id":"CVE-2025-67030","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":8.3,"impactScore":3.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-67030","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-67030","date":"2026-10-27","epss":0.00689,"percentile":0.52546}],"urls":["https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec","https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642","https://github.com/codehaus-plexus/plexus-utils/issues/294","https://github.com/codehaus-plexus/plexus-utils/pull/295","https://github.com/codehaus-plexus/plexus-utils/pull/296","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:35990","https://access.redhat.com/errata/RHSA-2026:35991","https://access.redhat.com/errata/RHSA-2026:35992","https://access.redhat.com/errata/RHSA-2026:35996","https://access.redhat.com/errata/RHSA-2026:35997","https://access.redhat.com/errata/RHSA-2026:36012","https://access.redhat.com/errata/RHSA-2026:38500","https://access.redhat.com/errata/RHSA-2026:38514","https://access.redhat.com/errata/RHSA-2026:38796","https://access.redhat.com/errata/RHSA-2026:40841","https://access.redhat.com/errata/RHSA-2026:41948","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:7109","https://access.redhat.com/errata/RHSA-2026:7380","https://access.redhat.com/security/cve/CVE-2025-67030","https://bugzilla.redhat.com/show_bug.cgi?id=2451409","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67030.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-67030","description":"Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code"}]},{"artifact":{"id":"6e8950072a4d1708","cpes":["cpe:2.3:a:org.eclipse.jetty.ee8.security:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8.security:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8.security:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8.security:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.ee8:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:security:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:security:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8-security:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8_security:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:ee8:jetty-ee8-security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:ee8:jetty_ee8_security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:security:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-ee8:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_ee8:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:security:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:ee8:security:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:ee8:jetty:12.0.33:*:*:*:*:*:*:*"],"name":"jetty-ee8-security","purl":"pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-security@12.0.33","type":"java-archive","version":"12.0.33","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.eclipse.jetty.ee8","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jetty-ee8-security-12.0.33.jar","manifestName":"","pomArtifactID":"jetty-ee8-security","archiveDigests":[{"value":"6a75f845a79b3f4458fa5fe46311e62facd9b719","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jetty-ee8-security-12.0.33.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.36"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fvj-hgj9-j2gr","versionConstraint":">=12.0.0,<=12.0.35 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty.ee8:jetty-ee8-security","version":"12.0.33"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2fvj-hgj9-j2gr","fix":{"state":"fixed","versions":["12.0.36"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"12.0.36"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-27","epss":0.00632,"percentile":0.50096}],"risk":0.51192,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://github.com/jetty/jetty.project/issues/15136","https://github.com/jetty/jetty.project/pull/15160","https://github.com/jetty/jetty.project/pull/15183","https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d","https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fvj-hgj9-j2gr","description":"Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution"},"relatedVulnerabilities":[{"id":"CVE-2026-10050","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10050","cwe":"CWE-173","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2026-10050","cwe":"CWE-303","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-10050","date":"2026-10-27","epss":0.00632,"percentile":0.50096}],"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10050","description":"In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jppx-w49h-x2qq","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jppx-w49h-x2qq","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-27","epss":0.0063,"percentile":0.49964}],"risk":0.5103,"urls":["https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","https://nvd.nist.gov/vuln/detail/CVE-2026-56745","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","description":"Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-56745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56745","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56745","date":"2026-10-27","epss":0.0063,"percentile":0.49964}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6jqx-86gh-f27w","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6jqx-86gh-f27w","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-27","epss":0.00665,"percentile":0.51589}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","https://nvd.nist.gov/vuln/detail/CVE-2026-55831","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","description":"Netty SPDY SETTINGS frame count materializes unbounded settings map"},"relatedVulnerabilities":[{"id":"CVE-2026-55831","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55831","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55831","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55831","date":"2026-10-27","epss":0.00665,"percentile":0.51589}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvh2-crg5-v77c","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvh2-crg5-v77c","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-27","epss":0.00665,"percentile":0.51589}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","https://nvd.nist.gov/vuln/detail/CVE-2026-55833","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","description":"Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation"},"relatedVulnerabilities":[{"id":"CVE-2026-55833","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55833","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55833","date":"2026-10-27","epss":0.00665,"percentile":0.51589}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"1f4e62e797862c40","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"ce03862f1ce5e4bd5a8af688ac9f5146a8192867","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-93wv-jw9v-4972","versionConstraint":">=4.2.0,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-93wv-jw9v-4972","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-08-01","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-27","epss":0.00665,"percentile":0.51588}],"risk":0.49874999999999997,"urls":["https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972","https://nvd.nist.gov/vuln/detail/CVE-2026-56819","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-93wv-jw9v-4972","description":"Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-56819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56819","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-56819","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56819","date":"2026-10-27","epss":0.00665,"percentile":0.51588}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56819","description":"Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4xh-88c3-wmh7","versionConstraint":">=2.19.0,<2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4xh-88c3-wmh7","fix":{"state":"fixed","versions":["2.21.6"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-27","epss":0.00628,"percentile":0.49884}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4xh-88c3-wmh7","description":"jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS"},"relatedVulnerabilities":[{"id":"CVE-2026-68497","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68497","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-68497","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68497","date":"2026-10-27","epss":0.00628,"percentile":0.49884}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68497","description":"jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f195d06d8a96e84d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-core-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"47b013fc85dbb819f3ba51e95a5560d0f1c4121c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-core-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p6pp-m3f8-5c89","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p6pp-m3f8-5c89","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-27","epss":0.00628,"percentile":0.49877}],"risk":0.471,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89","description":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"},"relatedVulnerabilities":[{"id":"CVE-2026-89407","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89407","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89407","cwe":"CWE-1333","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89407","date":"2026-10-27","epss":0.00628,"percentile":0.49877}],"urls":["https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan."}]},{"artifact":{"id":"039d5524c110eb3e","cpes":["cpe:2.3:a:bcpkix-jdk15to18:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk15to18:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk15to18:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcpkix-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcpkix-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcpkix-jdk15to18","archiveDigests":[{"value":"c332d3508cf24dea645c303db2dddf5cc5b44c15","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcpkix-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wg6q-6289-32hp","versionConstraint":">=1.49,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpkix-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wg6q-6289-32hp","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-27","epss":0.00777,"percentile":0.55615}],"risk":0.439005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5588","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wg6q-6289-32hp","description":"Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules"},"relatedVulnerabilities":[{"id":"CVE-2026-5588","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-27","epss":0.00777,"percentile":0.55615}],"urls":["https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-5588","https://bugzilla.redhat.com/show_bug.cgi?id=2458634","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11."}]},{"artifact":{"id":"85966f10a1a59cb3","cpes":["cpe:2.3:a:org.bouncycastle:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk18on:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix-jdk18on:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk18on:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix_jdk18on:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix-jdk18on:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcpkix:bcpkix_jdk18on:1.81:*:*:*:*:*:*:*"],"name":"bcpkix-jdk18on","purl":"pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcpkix-jdk18on-1.81.jar","manifestName":"","pomArtifactID":"bcpkix-jdk18on","archiveDigests":[{"value":"819fd6f5d170c8b8bf8c5acc73816e9c36574042","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcpkix-jdk18on-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wg6q-6289-32hp","versionConstraint":">=1.49,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcpkix-jdk18on","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wg6q-6289-32hp","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-17","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-27","epss":0.00777,"percentile":0.55615}],"risk":0.439005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5588","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wg6q-6289-32hp","description":"Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules"},"relatedVulnerabilities":[{"id":"CVE-2026-5588","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5588","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-5588","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-5588","date":"2026-10-27","epss":0.00777,"percentile":0.55615}],"urls":["https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-5588","https://bugzilla.redhat.com/show_bug.cgi?id=2458634","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5588.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5588","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules), Legion of the Bouncy Castle Inc. BCPIX-LTS bcpkix on All (pkix modules).\n\n This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java, JcaContentVerfierProviderBuilder.Java.\n\n\n\nThis issue affects BC-JAVA: from 1.67 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11; BCPIX-LTS: from 2.73.7 before 2.73.11."}]},{"artifact":{"id":"2b3afcc4f75e7920","cpes":["cpe:2.3:a:apache:shiro-core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-core","purl":"pkg:maven/org.apache.shiro/shiro-core@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-core","archiveDigests":[{"value":"7e542e3d614b197bf10005e98e19f9f19cb943e7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.2.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x96m-rh44-vgv8","versionConstraint":"<2.2.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-core","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x96m-rh44-vgv8","fix":{"state":"fixed","versions":["2.2.1"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"2.2.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L/U:Red","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49268","cwe":"CWE-90","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49268","date":"2026-10-27","epss":0.00512,"percentile":0.43448}],"risk":0.4172800000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49268","https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s","http://www.openwall.com/lists/oss-security/2026/06/17/8"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x96m-rh44-vgv8","description":"Apache Shiro: LDAP DN Injection in DefaultLdapRealm"},"relatedVulnerabilities":[{"id":"CVE-2026-49268","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:Red","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49268","cwe":"CWE-90","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49268","date":"2026-10-27","epss":0.00512,"percentile":0.43448}],"urls":["https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s","http://www.openwall.com/lists/oss-security/2026/06/17/8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49268","description":"A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.\n\nThis issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm\nUpgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue."}]},{"artifact":{"id":"3ce5c3eae6e0bb05","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.3","type":"java-archive","version":"1.15.3","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"f6e1d8a8819f854b681c8eaa57fd59a42329e10c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65r4-943x-97jj","versionConstraint":"<1.23.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65r4-943x-97jj","fix":{"state":"fixed","versions":["1.23.2"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"1.23.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-10-27","epss":0.00525,"percentile":0.44322}],"risk":0.40950000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-75140","https://github.com/jhy/jsoup/pull/2556","https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65r4-943x-97jj","description":"jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarations"},"relatedVulnerabilities":[{"id":"CVE-2026-75140","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75140","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75140","date":"2026-10-27","epss":0.00525,"percentile":0.44322}],"urls":["https://github.com/jhy/jsoup/commit/862ba2f1d48ee95609183dbcfc848c9fd7afc76a","https://github.com/jhy/jsoup/pull/2556","https://www.vulncheck.com/advisories/jsoup-uncontrolled-resource-consumption-in-xmltreebuilder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75140","description":"jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application."}]},{"artifact":{"id":"f195d06d8a96e84d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-core-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"47b013fc85dbb819f3ba51e95a5560d0f1c4121c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-core-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hhh-6rmp-j9qf","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hhh-6rmp-j9qf","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-10-01","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-27","epss":0.00532,"percentile":0.44773}],"risk":0.399,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","https://nvd.nist.gov/vuln/detail/CVE-2026-89425","https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.18.11","https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hhh-6rmp-j9qf","description":"jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-89425","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89425","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-89425","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-89425","date":"2026-10-27","epss":0.00532,"percentile":0.44773}],"urls":["https://github.com/FasterXML/jackson-core/pull/1698","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89425","description":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}]},{"artifact":{"id":"70310a906100202f","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-27","epss":0.0043,"percentile":0.37071}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-27","epss":0.0043,"percentile":0.37071}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"518b0d5c77085371","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-27","epss":0.0043,"percentile":0.37071}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-27","epss":0.0043,"percentile":0.37071}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"1fd52c6011955ffd","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.81.1","type":"java-archive","version":"1.81.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"07bcb4c4664600c51190ab3774710a51bfdeb2eb","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9pwp-9qqc-pr26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.81.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9pwp-9qqc-pr26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-27","epss":0.0043,"percentile":0.37071}],"risk":0.3913,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8763","https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE-2026-8763","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763","https://github.com/bcgit/bc-java/releases/tag/r1rv85v2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9pwp-9qqc-pr26","description":"Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI"},"relatedVulnerabilities":[{"id":"CVE-2026-8763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8763","cwe":"CWE-295","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8763","date":"2026-10-27","epss":0.0043,"percentile":0.37071}],"urls":["https://github.com/bcgit/bc-java/commit/2c28b253a44681fbbc562561eab6ad383d2ae558","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908763"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8763","description":"In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"1f4e62e797862c40","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"ce03862f1ce5e4bd5a8af688ac9f5146a8192867","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c2gf-v879-257j","versionConstraint":">=4.2.0.Alpha1,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c2gf-v879-257j","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-11","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-10-27","epss":0.00753,"percentile":0.54863}],"risk":0.387795,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://nvd.nist.gov/vuln/detail/CVE-2026-48043","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645","https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c2gf-v879-257j","description":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-48043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48043","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-401","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48043","cwe":"CWE-772","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48043","date":"2026-10-27","epss":0.00753,"percentile":0.54863}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-48043","https://bugzilla.redhat.com/show_bug.cgi?id=2488442","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"70310a906100202f","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-27","epss":0.00493,"percentile":0.4216}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-27","epss":0.00493,"percentile":0.4216}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"518b0d5c77085371","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-27","epss":0.00493,"percentile":0.4216}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-27","epss":0.00493,"percentile":0.4216}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"1fd52c6011955ffd","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.81.1","type":"java-archive","version":"1.81.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"07bcb4c4664600c51190ab3774710a51bfdeb2eb","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.85"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qp49-qgx5-5m26","versionConstraint":"<1.85 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.81.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qp49-qgx5-5m26","fix":{"state":"fixed","versions":["1.85"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"1.85"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-27","epss":0.00493,"percentile":0.4216}],"risk":0.38454000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13506","https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qp49-qgx5-5m26","description":"Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard"},"relatedVulnerabilities":[{"id":"CVE-2026-13506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13506","cwe":"CWE-674","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13506","date":"2026-10-27","epss":0.00493,"percentile":0.4216}],"urls":["https://github.com/bcgit/bc-java/commit/77454da9b3dcaaa2991412d1c3c1a6e1a338ff84","https://github.com/bcgit/bc-java/wiki/CVE-2026-13506"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13506","description":"In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series)."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gx83-3vf8-gh7j","versionConstraint":">=2.19.0,<2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gx83-3vf8-gh7j","fix":{"state":"fixed","versions":["2.21.6"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-27","epss":0.00717,"percentile":0.53613}],"risk":0.38001,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","description":"jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)"},"relatedVulnerabilities":[{"id":"CVE-2026-83557","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83557","cwe":"CWE-502","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-83557","cwe":"CWE-915","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-83557","date":"2026-10-27","epss":0.00717,"percentile":0.53613}],"urls":["https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","description":"DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of \"unsafe base types\", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2."}]},{"artifact":{"id":"f195d06d8a96e84d","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_core:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:core:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:core:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-core","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-core-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-core","archiveDigests":[{"value":"47b013fc85dbb819f3ba51e95a5560d0f1c4121c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-core-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7wm-3cxj-wff9","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-core","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7wm-3cxj-wff9","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-10-27","epss":0.00463,"percentile":0.39978}],"risk":0.3750299999999999,"urls":["https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://nvd.nist.gov/vuln/detail/CVE-2026-68494"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7wm-3cxj-wff9","description":"jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)"},"relatedVulnerabilities":[{"id":"CVE-2026-68494","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-68494","cwe":"CWE-770","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-68494","date":"2026-10-27","epss":0.00463,"percentile":0.39978}],"urls":["https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","https://github.com/FasterXML/jackson-core/pull/1611","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","https://github.com/advisories/GHSA-72hv-8253-57qq","https://www.cve.org/CVERecord?id=CVE-2026-18401"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","description":"The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass.\n\nThe earlier fix wired validateIntegerLength() into a new _setIntLength() helper and invoked it wherever the integer portion of a number is decided: a terminator byte arrives, a '.' or 'e'/'E' is seen, or input ends inside a fully buffered value. It was not invoked on the attacker-relevant path where the parser runs out of input while still inside the MINOR_NUMBER_INTEGER_DIGITS minor state and returns NOT_AVAILABLE to the caller.\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, keeps the parser inside MINOR_NUMBER_INTEGER_DIGITS indefinitely. _textBuffer.expandCurrentSegment() grows the accumulator on every chunk while validateIntegerLength() is never called. The accumulator is bounded only by maxStringLength (20 MiB by default) rather than by maxNumberLength (1000 by default), an amplification of roughly 20,000x over the documented limit. Because Java char values occupy two bytes, a single connection can be driven to approximately 40 MiB of heap before the validator finally fires when the value completes.\n\nThe equivalent fraction-path code is correct: _finishFloatFraction() calls _setFractLength() before its NOT_AVAILABLE return. The missing call affects the integer-digit paths in _startPositiveNumber(), _startNegativeNumber() and _finishNumberIntegralPart() in NonBlockingUtf8JsonParserBase.\n\nImpact: reactive frameworks such as Spring WebFlux/Reactor, Quarkus, Helidon and Vert.x feed inbound HTTP or gRPC bytes to the async parser as they arrive, which is precisely the chunked-feed shape required. Operators who set StreamReadConstraints.maxNumberLength expecting it to cap memory per number value do not get that guarantee; memory accumulates per concurrent connection and attacker-controlled concurrency can exhaust the JVM heap. The synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) and the async parser operating on complete input are not affected.\n\nExploitation requires only the ability to stream data to a parsing endpoint; no privileges or user interaction are needed.\n\nThis issue affects com.fasterxml.jackson.core:jackson-core from version 2.15.0 through 2.18.7, and from 2.19.0 through 2.21.3, and tools.jackson.core:jackson-core from 3.0.0 through 3.1.3. Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases. Note that GHSA-r7wm-3cxj-wff9 states the affected 2.x range without a lower bound. The 2.22.x and 3.2.x release lines are not affected: those branches were created after the fix commit landed on 2026-05-21 and therefore contain it from their initial releases (2.22.0, tagged 2026-06-03, and 3.2.0, tagged 2026-06-08)."}]},{"artifact":{"id":"0ac38171c6586546","cpes":["cpe:2.3:a:io.netty.codec-compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_compression:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-compression","purl":"pkg:maven/io.netty/netty-codec-compression@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-compression","archiveDigests":[{"value":"5cc88546ee2ac730041eb33dff868037c8e85e78","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558v-64gr-wgg4","versionConstraint":">=4.2.0.Final,<4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-compression","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558v-64gr-wgg4","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-27","epss":0.0046,"percentile":0.39703}],"risk":0.3726,"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558v-64gr-wgg4","description":"Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang"},"relatedVulnerabilities":[{"id":"CVE-2026-59901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59901","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59901","date":"2026-10-27","epss":0.0046,"percentile":0.39703}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59901","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"c549712d19d83e7a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"730b1c0df761ecae4de489b974efe29135d996f5","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c653-97m9-rcg9","versionConstraint":">=4.2.0.Final,<4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c653-97m9-rcg9","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-10-27","epss":0.00491,"percentile":0.41998}],"risk":0.36825,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50010","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c653-97m9-rcg9","description":"Netty: Wrapping plain trust manager silently disables hostname verification"},"relatedVulnerabilities":[{"id":"CVE-2026-50010","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50010","cwe":"CWE-347","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-50010","date":"2026-10-27","epss":0.00491,"percentile":0.41998}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:28573","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-50010","https://bugzilla.redhat.com/show_bug.cgi?id=2488429","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cxp5-3px4-pw24","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cxp5-3px4-pw24","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-27","epss":0.00487,"percentile":0.41716}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/pull/6204","https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","description":"jackson-databind quadratic forward-reference completion"},"relatedVulnerabilities":[{"id":"CVE-2026-91777","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91777","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91777","date":"2026-10-27","epss":0.00487,"percentile":0.41716}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","description":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wv8q-qhhj-9h54","versionConstraint":">=2.19.0,<=2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wv8q-qhhj-9h54","fix":{"state":"fixed","versions":["2.21.7"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.21.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-27","epss":0.00487,"percentile":0.41716}],"risk":0.36525,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","description":"jackson-databind retains every unknown raw type ID"},"relatedVulnerabilities":[{"id":"CVE-2026-91776","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91776","cwe":"CWE-400","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-91776","date":"2026-10-27","epss":0.00487,"percentile":0.41716}],"urls":["https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","description":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q4f6-jm68-57ww","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q4f6-jm68-57ww","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-27","epss":0.00609,"percentile":0.48949}],"risk":0.362355,"urls":["https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","description":"Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service"},"relatedVulnerabilities":[{"id":"CVE-2026-59899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59899","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59899","date":"2026-10-27","epss":0.00609,"percentile":0.48949}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"70310a906100202f","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-98j2-6v39-78w8","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-98j2-6v39-78w8","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-27","epss":0.00428,"percentile":0.36856}],"risk":0.34668,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-13505","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-98j2-6v39-78w8","description":"Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization."},"relatedVulnerabilities":[{"id":"CVE-2026-13505","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13505","cwe":"CWE-772","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-13505","date":"2026-10-27","epss":0.00428,"percentile":0.36856}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9013505"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13505","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and in an unspecified order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme."}]},{"artifact":{"id":"70310a906100202f","cpes":["cpe:2.3:a:bouncycastle-org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc-fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc_fips:bc_fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc-fips:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:bc:bc_fips:2.1.2:*:*:*:*:*:*:*"],"name":"bc-fips","purl":"pkg:maven/org.bouncycastle/bc-fips@2.1.2","type":"java-archive","version":"2.1.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","manifestName":"","pomArtifactID":"bc-fips","archiveDigests":[{"value":"061fbe8383f70489dda95a11a2a4739eb818ff2c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bc-fips-2.1.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v6w3-qrh8-qccc","versionConstraint":">=2.1.0,<2.1.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bc-fips","version":"2.1.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v6w3-qrh8-qccc","fix":{"state":"fixed","versions":["2.1.3"],"available":[{"date":"2026-09-19","kind":"first-observed","version":"2.1.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-27","epss":0.00428,"percentile":0.36852}],"risk":0.34668,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8798","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v6w3-qrh8-qccc","description":"Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound"},"relatedVulnerabilities":[{"id":"CVE-2026-8798","cvss":[{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8798","cwe":"CWE-835","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epss":[{"cve":"CVE-2026-8798","date":"2026-10-27","epss":0.00428,"percentile":0.36852}],"urls":["https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8798","description":"In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected."}]},{"artifact":{"id":"0ac38171c6586546","cpes":["cpe:2.3:a:io.netty.codec-compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_compression:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-compression:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_compression:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-compression","purl":"pkg:maven/io.netty/netty-codec-compression@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-compression","archiveDigests":[{"value":"5cc88546ee2ac730041eb33dff868037c8e85e78","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-compression-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mj4r-2hfc-f8p6","versionConstraint":"<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-compression","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mj4r-2hfc-f8p6","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42583","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42583","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42583","date":"2026-10-27","epss":0.00461,"percentile":0.39785}],"risk":0.34575000000000006,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6","https://nvd.nist.gov/vuln/detail/CVE-2026-42583"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mj4r-2hfc-f8p6","description":"Netty Lz4FrameDecoder is vulnerable to resource exhaustion"},"relatedVulnerabilities":[{"id":"CVE-2026-42583","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42583","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42583","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42583","date":"2026-10-27","epss":0.00461,"percentile":0.39785}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42583","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xxqh-mfjm-7mv9","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xxqh-mfjm-7mv9","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42581","date":"2026-10-27","epss":0.0063,"percentile":0.50004}],"risk":0.3402,"urls":["https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","https://nvd.nist.gov/vuln/detail/CVE-2026-42581"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xxqh-mfjm-7mv9","description":"Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization"},"relatedVulnerabilities":[{"id":"CVE-2026-42581","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42581","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42581","date":"2026-10-27","epss":0.0063,"percentile":0.50004}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42581","https://bugzilla.redhat.com/show_bug.cgi?id=2477232","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"857c7b15680497bf","cpes":["cpe:2.3:a:apache:log4j-api:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j_api:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:log4j:2.19.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:api:2.19.0:*:*:*:*:*:*:*"],"name":"log4j-api","purl":"pkg:maven/org.apache.logging.log4j/log4j-api@2.19.0","type":"java-archive","version":"2.19.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.logging.log4j","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/log4j-api-2.19.0.jar","manifestName":"","pomArtifactID":"log4j-api","archiveDigests":[{"value":"ea1b37f38c327596b216542bc636cfdc0b8036fa","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/log4j-api-2.19.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.25.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qv9r-c865-cp47","versionConstraint":">=2.13.1,<2.25.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.logging.log4j:log4j-api","version":"2.19.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qv9r-c865-cp47","fix":{"state":"fixed","versions":["2.25.5"],"available":[{"date":"2026-08-14","kind":"first-observed","version":"2.25.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-27","epss":0.00595,"percentile":0.48233}],"risk":0.33617499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-49844","https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844","https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300","https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82","https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5","https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qv9r-c865-cp47","description":"Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization"},"relatedVulnerabilities":[{"id":"CVE-2026-49844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49844","cwe":"CWE-116","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-49844","date":"2026-10-27","epss":0.00595,"percentile":0.48233}],"urls":["https://github.com/apache/logging-log4j2/pull/4163","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49844","description":"Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n  *  The application uses the  message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message  of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n  *  The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values."}]},{"artifact":{"id":"530dea1634359c07","cpes":["cpe:2.3:a:io.netty.codec-dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_dns:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_dns:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-dns","purl":"pkg:maven/io.netty/netty-codec-dns@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-dns","archiveDigests":[{"value":"693b6a173f4e510c00d784f80d309c25ba547aaa","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-dns-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mfg7-5gfp-c4w3","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-dns","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mfg7-5gfp-c4w3","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-25","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73508","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-73508","date":"2026-10-27","epss":0.0063,"percentile":0.49979}],"risk":0.32445,"urls":["https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3","https://github.com/netty/netty/pull/17063","https://github.com/netty/netty/pull/17065","https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mfg7-5gfp-c4w3","description":"Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names"},"relatedVulnerabilities":[{"id":"CVE-2026-73508","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73508","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-73508","date":"2026-10-27","epss":0.0063,"percentile":0.49979}],"urls":["https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73508","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"f1fc2d49c63469ce","cpes":["cpe:2.3:a:io.netty.handler-proxy:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler-proxy:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler-proxy:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler-proxy:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler-proxy:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler_proxy:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler-proxy:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler_proxy:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler-proxy:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler_proxy:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-handler-proxy","purl":"pkg:maven/io.netty/netty-handler-proxy@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-proxy-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-handler-proxy","archiveDigests":[{"value":"4bbc9268168336caee75955a53b37867c99555c7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-proxy-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-45q3-82m4-75jr","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler-proxy","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-45q3-82m4-75jr","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42578","cwe":"CWE-113","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42578","cwe":"CWE-93","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42578","date":"2026-10-27","epss":0.01065,"percentile":0.64511}],"risk":0.314175,"urls":["https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr","https://github.com/advisories/GHSA-84h7-rjj3-6jx4","https://nvd.nist.gov/vuln/detail/CVE-2026-42578"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-45q3-82m4-75jr","description":"Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)"},"relatedVulnerabilities":[{"id":"CVE-2026-42578","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42578","cwe":"CWE-113","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42578","cwe":"CWE-93","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42578","date":"2026-10-27","epss":0.01065,"percentile":0.64511}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr","https://access.redhat.com/errata/RHSA-2026:23808","https://access.redhat.com/errata/RHSA-2026:24502","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42578","https://bugzilla.redhat.com/show_bug.cgi?id=2477226","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42578.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42578","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"8baacca5780078e7","cpes":["cpe:2.3:a:io.netty.transport-classes-epoll:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-classes-epoll:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-classes-epoll:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-classes-epoll:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes-epoll:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes_epoll:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-classes:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_classes:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes-epoll:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes_epoll:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-classes:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_classes:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport-classes-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport_classes_epoll:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-transport-classes-epoll","purl":"pkg:maven/io.netty/netty-transport-classes-epoll@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-transport-classes-epoll-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-transport-classes-epoll","archiveDigests":[{"value":"6d3396999238ce440c15c5258381f23b5f6083f3","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-transport-classes-epoll-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rwm7-x88c-3g2p","versionConstraint":">=4.2.0.Final,<4.2.13.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-transport-classes-epoll","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rwm7-x88c-3g2p","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-07-25","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42577","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42577","date":"2026-10-27","epss":0.00408,"percentile":0.34889}],"risk":0.30600000000000005,"urls":["https://github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2p","https://github.com/netty/netty/pull/16689","https://github.com/netty/netty/commit/0ec3d97fab376e243d328ac95fbd288ba0f6e22d","https://nvd.nist.gov/vuln/detail/CVE-2026-42577"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rwm7-x88c-3g2p","description":"Netty epoll transport denial of service via RST on half-closed TCP connection"},"relatedVulnerabilities":[{"id":"CVE-2026-42577","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42577","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42577","date":"2026-10-27","epss":0.00408,"percentile":0.34889}],"urls":["https://github.com/netty/netty/commit/0ec3d97fab376e243d328ac95fbd288ba0f6e22d","https://github.com/netty/netty/pull/16689","https://github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2p"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42577","description":"Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final."}]},{"artifact":{"id":"ab6111989cd6a50c","cpes":["cpe:2.3:a:io.netty.resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-resolver-dns","purl":"pkg:maven/io.netty/netty-resolver-dns@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-resolver-dns","archiveDigests":[{"value":"7424b52366c642e833e4cd5846c6ef07d05eb5c2","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5pvg-856g-cp85","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-resolver-dns","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5pvg-856g-cp85","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47691","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-47691","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-47691","date":"2026-10-27","epss":0.00372,"percentile":0.30949}],"risk":0.30132000000000003,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-47691","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-47691","https://bugzilla.redhat.com/show_bug.cgi?id=2488439","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5pvg-856g-cp85","description":"Netty has Insufficient Bailiwick Validation for NS Records"},"relatedVulnerabilities":[{"id":"CVE-2026-47691","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"impactScore":5.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47691","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-47691","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-47691","date":"2026-10-27","epss":0.00372,"percentile":0.30949}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-47691","https://bugzilla.redhat.com/show_bug.cgi?id=2488439","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47691","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wjgm-6hv5-3cvf","versionConstraint":">=2.19.0,<2.21.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wjgm-6hv5-3cvf","fix":{"state":"fixed","versions":["2.21.6"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-27","epss":0.00572,"percentile":0.47106}],"risk":0.29458,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","description":"jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-19032","cvss":[{"type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19032","cwe":"CWE-470","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"cve":"CVE-2026-19032","cwe":"CWE-610","type":"Secondary","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"epss":[{"cve":"CVE-2026-19032","date":"2026-10-27","epss":0.00572,"percentile":0.47106}],"urls":["https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}]},{"artifact":{"id":"225fe840083bdd83","cpes":["cpe:2.3:a:org.springframework:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:6.2.17:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@6.2.17","type":"java-archive","version":"6.2.17","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-expression-6.2.17.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"d2f104d59e9a2d70c7f55c50c79417a63a24ad86","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-expression-6.2.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r5w3-xv2f-j59q","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"6.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r5w3-xv2f-j59q","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-31","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41850","cwe":"CWE-407","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41850","date":"2026-10-27","epss":0.00387,"percentile":0.32587}],"risk":0.29025,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41850","https://spring.io/security/cve-2026-41850","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r5w3-xv2f-j59q","description":"Spring Framework Algorithmic Denial of Service via SpEL Expressions"},"relatedVulnerabilities":[{"id":"CVE-2026-41850","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41850","cwe":"CWE-407","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41850","date":"2026-10-27","epss":0.00387,"percentile":0.32587}],"urls":["https://spring.io/security/cve-2026-41850"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41850","description":"Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"c549712d19d83e7a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"730b1c0df761ecae4de489b974efe29135d996f5","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.17.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4c3-7fpv-j4q5","versionConstraint":">=4.2.0.Final,<=4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4c3-7fpv-j4q5","fix":{"state":"fixed","versions":["4.2.17.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.2.17.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-27","epss":0.00316,"percentile":0.24332}],"risk":0.28598,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","https://nvd.nist.gov/vuln/detail/CVE-2026-75595","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","description":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"},"relatedVulnerabilities":[{"id":"CVE-2026-75595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75595","cwe":"CWE-754","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75595","date":"2026-10-27","epss":0.00316,"percentile":0.24332}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"518b0d5c77085371","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-574f-3g2m-x479","versionConstraint":"=1.81.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-574f-3g2m-x479","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-27","epss":0.0032,"percentile":0.24785}],"risk":0.27840000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-14813","https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://access.redhat.com/security/cve/CVE-2025-14813","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-574f-3g2m-x479","description":"Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks"},"relatedVulnerabilities":[{"id":"CVE-2025-14813","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2025-14813","cwe":"CWE-327","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-14813","date":"2026-10-27","epss":0.0032,"percentile":0.24785}],"urls":["https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3","https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2025-14813","https://bugzilla.redhat.com/show_bug.cgi?id=2458640","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14813","description":": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\n\n This vulnerability is associated with program files G3413CTRBlockCipher.\n\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"518b0d5c77085371","cpes":["cpe:2.3:a:bcprov-jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15to18:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15to18:1.81:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15to18:1.81:*:*:*:*:*:*:*"],"name":"bcprov-jdk15to18","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.81","type":"java-archive","version":"1.81","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","manifestName":"","pomArtifactID":"bcprov-jdk15to18","archiveDigests":[{"value":"e5961a1649ee994ed27009ec04778356d0b1292d","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk15to18-1.81.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c3fc-8qff-9hwx","versionConstraint":">=1.74,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15to18","version":"1.81"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c3fc-8qff-9hwx","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-27","epss":0.00527,"percentile":0.44458}],"risk":0.276675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-0636","https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","description":"Bouncy Castle has an LDAP injection"},"relatedVulnerabilities":[{"id":"CVE-2026-0636","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-27","epss":0.00527,"percentile":0.44458}],"urls":["https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-0636","https://bugzilla.redhat.com/show_bug.cgi?id=2458641","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"1fd52c6011955ffd","cpes":["cpe:2.3:a:org.bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk18on:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk18on:1.81.1:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk18on:1.81.1:*:*:*:*:*:*:*"],"name":"bcprov-jdk18on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk18on@1.81.1","type":"java-archive","version":"1.81.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","manifestName":"","pomArtifactID":"bcprov-jdk18on","archiveDigests":[{"value":"07bcb4c4664600c51190ab3774710a51bfdeb2eb","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/bcprov-jdk18on-1.81.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.84"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c3fc-8qff-9hwx","versionConstraint":">=1.74,<1.84 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk18on","version":"1.81.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c3fc-8qff-9hwx","fix":{"state":"fixed","versions":["1.84"],"available":[{"date":"2026-04-18","kind":"first-observed","version":"1.84"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-27","epss":0.00527,"percentile":0.44458}],"risk":0.276675,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-0636","https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c3fc-8qff-9hwx","description":"Bouncy Castle has an LDAP injection"},"relatedVulnerabilities":[{"id":"CVE-2026-0636","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:Amber","metrics":{"baseScore":5.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"cve":"CVE-2026-0636","cwe":"CWE-90","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0636","date":"2026-10-27","epss":0.00527,"percentile":0.44458}],"urls":["https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636","https://access.redhat.com/errata/RHSA-2026:11720","https://access.redhat.com/errata/RHSA-2026:11721","https://access.redhat.com/errata/RHSA-2026:13631","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276","https://access.redhat.com/errata/RHSA-2026:17668","https://access.redhat.com/errata/RHSA-2026:18054","https://access.redhat.com/errata/RHSA-2026:18055","https://access.redhat.com/errata/RHSA-2026:18059","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:60239","https://access.redhat.com/errata/RHSA-2026:60246","https://access.redhat.com/errata/RHSA-2026:60247","https://access.redhat.com/errata/RHSA-2026:60248","https://access.redhat.com/errata/RHSA-2026:60249","https://access.redhat.com/errata/RHSA-2026:60250","https://access.redhat.com/errata/RHSA-2026:60251","https://access.redhat.com/errata/RHSA-2026:60252","https://access.redhat.com/errata/RHSA-2026:60254","https://access.redhat.com/errata/RHSA-2026:60256","https://access.redhat.com/errata/RHSA-2026:60259","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/security/cve/CVE-2026-0636","https://bugzilla.redhat.com/show_bug.cgi?id=2458641","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0636.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0636","description":"Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).\n\n This vulnerability is associated with program files LDAPStoreHelper.\n\n\n\nThis issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."}]},{"artifact":{"id":"bbd202650e98b6e1","cpes":["cpe:2.3:a:com.google.guava:guava:32.1.2-jre:*:*:*:*:*:*:*","cpe:2.3:a:google:guava:32.1.2-jre:*:*:*:*:*:*:*","cpe:2.3:a:guava:guava:32.1.2-jre:*:*:*:*:*:*:*"],"name":"guava","purl":"pkg:maven/com.google.guava/guava@32.1.2-jre","type":"java-archive","version":"32.1.2-jre","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.google.guava","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/guava-32.1.2-jre.jar","manifestName":"","pomArtifactID":"guava","archiveDigests":[{"value":"5e64ec7e056456bef3a4bc4c6fdaef71e8ab6318","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/guava-32.1.2-jre.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"33.7.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xxph-c9ww-hj94","versionConstraint":">=4.0,<=33.7.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.google.guava:guava","version":"32.1.2-jre"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xxph-c9ww-hj94","fix":{"state":"fixed","versions":["33.7.2"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"33.7.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102554","cwe":"CWE-502","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-102554","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-102554","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"risk":0.25608000000000003,"urls":["https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94","https://nvd.nist.gov/vuln/detail/CVE-2026-102554","https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","https://github.com/google/guava/releases/tag/v33.7.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xxph-c9ww-hj94","description":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation"},"relatedVulnerabilities":[{"id":"CVE-2026-102554","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102554","cwe":"CWE-502","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-102554","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-102554","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"urls":["https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","https://github.com/google/guava/releases/tag/v33.7.2","https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gcjf-9mgh-3p7g","versionConstraint":">=4.2.0.Final,<4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gcjf-9mgh-3p7g","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-27","epss":0.00465,"percentile":0.40112}],"risk":0.248775,"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","description":"Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"},"relatedVulnerabilities":[{"id":"CVE-2026-59921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59921","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59921","date":"2026-10-27","epss":0.00465,"percentile":0.40112}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"1b70f1a64a3a5207","cpes":["cpe:2.3:a:spring-security-saml2-service-provider:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-saml2-service-provider","purl":"pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-saml2-service-provider","archiveDigests":[{"value":"e3c202a32f607cae7909508c9c4b377dd382132c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m69x-pw9p-7j3q","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-saml2-service-provider","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m69x-pw9p-7j3q","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-12","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40988","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40988","date":"2026-10-27","epss":0.00331,"percentile":0.26134}],"risk":0.24825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-40988","https://spring.io/security/cve-2026-40988","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m69x-pw9p-7j3q","description":"Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)"},"relatedVulnerabilities":[{"id":"CVE-2026-40988","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40988","cwe":"CWE-400","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40988","date":"2026-10-27","epss":0.00331,"percentile":0.26134}],"urls":["https://spring.io/security/cve-2026-40988"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40988","description":"An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4mp9-239f-g9hg","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4mp9-239f-g9hg","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-27","epss":0.00439,"percentile":0.37971}],"risk":0.24803499999999998,"urls":["https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","description":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation"},"relatedVulnerabilities":[{"id":"CVE-2026-59898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59898","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59898","date":"2026-10-27","epss":0.00439,"percentile":0.37971}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","description":"Netty is an asynchronous, event-driven network application framework.  Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pjw-73gf-8qr5","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pjw-73gf-8qr5","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-27","epss":0.00423,"percentile":0.3644}],"risk":0.243225,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5","https://nvd.nist.gov/vuln/detail/CVE-2026-59888","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pjw-73gf-8qr5","description":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy"},"relatedVulnerabilities":[{"id":"CVE-2026-59888","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59888","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59888","date":"2026-10-27","epss":0.00423,"percentile":0.3644}],"urls":["https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d","https://github.com/FasterXML/jackson-databind/pull/5974","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59888","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"1f4e62e797862c40","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"ce03862f1ce5e4bd5a8af688ac9f5146a8192867","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c69g-56f8-xwqj","versionConstraint":">=4.2.0.Final,<=4.2.15.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c69g-56f8-xwqj","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-27","epss":0.00398,"percentile":0.3387}],"risk":0.23680999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c69g-56f8-xwqj","description":"Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-59900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59900","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59900","date":"2026-10-27","epss":0.00398,"percentile":0.3387}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59900","description":"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"ab6111989cd6a50c","cpes":["cpe:2.3:a:io.netty.resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-resolver-dns","purl":"pkg:maven/io.netty/netty-resolver-dns@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-resolver-dns","archiveDigests":[{"value":"7424b52366c642e833e4cd5846c6ef07d05eb5c2","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-676x-f7gg-47vc","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-resolver-dns","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-676x-f7gg-47vc","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45674","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45674","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45674","date":"2026-10-27","epss":0.00292,"percentile":0.2163}],"risk":0.23651999999999995,"urls":["https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45674","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/security/cve/CVE-2026-45674","https://bugzilla.redhat.com/show_bug.cgi?id=2488400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:53806","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:53645"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-676x-f7gg-47vc","description":"Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records"},"relatedVulnerabilities":[{"id":"CVE-2026-45674","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"impactScore":5.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"impactScore":5.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45674","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45674","cwe":"CWE-346","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45674","date":"2026-10-27","epss":0.00292,"percentile":0.2163}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:37390","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49700","https://access.redhat.com/errata/RHSA-2026:49701","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/security/cve/CVE-2026-45674","https://bugzilla.redhat.com/show_bug.cgi?id=2488400","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45674","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.16.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6cqp-g7gg-8hr5","versionConstraint":">=4.2.0.Final,<4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6cqp-g7gg-8hr5","fix":{"state":"fixed","versions":["4.2.16.Final"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"4.2.16.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-27","epss":0.00408,"percentile":0.34903}],"risk":0.2346,"urls":["https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","https://nvd.nist.gov/vuln/detail/CVE-2026-56746","https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","description":"Netty: Security Control Bypass via CORS Short-Circuit Failure"},"relatedVulnerabilities":[{"id":"CVE-2026-56746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56746","cwe":"CWE-284","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-56746","date":"2026-10-27","epss":0.00408,"percentile":0.34903}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","description":"Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9fxm-vc8v-hj55","versionConstraint":">=2.21.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9fxm-vc8v-hj55","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54516","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54516","date":"2026-10-27","epss":0.00449,"percentile":0.38847}],"risk":0.231235,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55","https://github.com/FasterXML/jackson-databind/pull/5967","https://github.com/FasterXML/jackson-databind/pull/5968","https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a","https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af","https://nvd.nist.gov/vuln/detail/CVE-2026-54516"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9fxm-vc8v-hj55","description":"jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields"},"relatedVulnerabilities":[{"id":"CVE-2026-54516","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54516","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54516","date":"2026-10-27","epss":0.00449,"percentile":0.38847}],"urls":["https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a","https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af","https://github.com/FasterXML/jackson-databind/pull/5967","https://github.com/FasterXML/jackson-databind/pull/5968","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54516","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5jmj-h7xm-6q6v","versionConstraint":">=2.19.0,<2.21.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5jmj-h7xm-6q6v","fix":{"state":"fixed","versions":["2.21.5"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-27","epss":0.00443,"percentile":0.38298}],"risk":0.228145,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://nvd.nist.gov/vuln/detail/CVE-2026-54515"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","description":"jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties"},"relatedVulnerabilities":[{"id":"CVE-2026-54515","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54515","cwe":"CWE-915","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54515","date":"2026-10-27","epss":0.00443,"percentile":0.38298}],"urls":["https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","https://github.com/FasterXML/jackson-databind/issues/5962","https://github.com/FasterXML/jackson-databind/issues/5964","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4."}]},{"artifact":{"id":"2b3afcc4f75e7920","cpes":["cpe:2.3:a:apache:shiro-core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-core","purl":"pkg:maven/org.apache.shiro/shiro-core@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-core","archiveDigests":[{"value":"7e542e3d614b197bf10005e98e19f9f19cb943e7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fcvm-3cpj-f9qx","versionConstraint":">=1.0.0-incubating,<2.2.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-core","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fcvm-3cpj-f9qx","fix":{"state":"fixed","versions":["2.2.0"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"2.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43827","cwe":"CWE-384","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43827","date":"2026-10-27","epss":0.00412,"percentile":0.35312}],"risk":0.22454000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-43827","https://shiro.apache.org/security-reports.html#cve_2026_43827","http://www.openwall.com/lists/oss-security/2026/05/25/6"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fcvm-3cpj-f9qx","description":"Apache Shiro has a session fixation vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-43827","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43827","cwe":"CWE-384","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43827","date":"2026-10-27","epss":0.00412,"percentile":0.35312}],"urls":["https://shiro.apache.org/security-reports.html#cve_2026_43827","http://www.openwall.com/lists/oss-security/2026/05/25/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43827","description":"Default configurations of Apache Shiro have a session fixation vulnerability.\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID."}]},{"artifact":{"id":"c549712d19d83e7a","cpes":["cpe:2.3:a:io.netty.handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:handler:handler:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:handler:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-handler","purl":"pkg:maven/io.netty/netty-handler@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-handler","archiveDigests":[{"value":"730b1c0df761ecae4de489b974efe29135d996f5","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-handler-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.17.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fccg-mwvh-qqg4","versionConstraint":">=4.2.0.Final,<=4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-handler","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fccg-mwvh-qqg4","fix":{"state":"fixed","versions":["4.2.17.Final"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"4.2.17.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-27","epss":0.00374,"percentile":0.31169}],"risk":0.22253,"urls":["https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","https://nvd.nist.gov/vuln/detail/CVE-2026-75596","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","description":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-75596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75596","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-75596","date":"2026-10-27","epss":0.00374,"percentile":0.31169}],"urls":["https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-27","epss":0.0043,"percentile":0.37026}],"risk":0.220375,"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[]},{"artifact":{"id":"1f4e62e797862c40","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"ce03862f1ce5e4bd5a8af688ac9f5146a8192867","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-563q-j3cm-6jxm","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-563q-j3cm-6jxm","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50560","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50560","date":"2026-10-27","epss":0.00397,"percentile":0.33724}],"risk":0.22033499999999992,"urls":["https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://nvd.nist.gov/vuln/detail/CVE-2026-50560","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-563q-j3cm-6jxm","description":"Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature"},"relatedVulnerabilities":[{"id":"CVE-2026-50560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50560","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50560","date":"2026-10-27","epss":0.00397,"percentile":0.33724}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50560","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m4cv-j2px-7723","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m4cv-j2px-7723","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42580","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42580","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42580","date":"2026-10-27","epss":0.00378,"percentile":0.31583}],"risk":0.21734999999999996,"urls":["https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723","https://nvd.nist.gov/vuln/detail/CVE-2026-42580"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m4cv-j2px-7723","description":"Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-42580","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42580","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-42580","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42580","date":"2026-10-27","epss":0.00378,"percentile":0.31583}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42580","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"6223778fe09545dd","cpes":["cpe:2.3:a:org.sonatype.buildsupport:ognl:3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:buildsupport:ognl:3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:ognl:3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:ognl:ognl:3.4.2:*:*:*:*:*:*:*"],"name":"ognl","purl":"pkg:maven/ognl/ognl@3.4.2","type":"java-archive","version":"3.4.2","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"ognl","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/mybatis-3.5.15.jar:ognl:ognl","manifestName":"","pomArtifactID":"ognl","archiveDigests":null},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/mybatis-3.5.15.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.4.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crwc-vw2r-qr6m","versionConstraint":"<=3.4.12 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ognl:ognl","version":"3.4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-crwc-vw2r-qr6m","fix":{"state":"fixed","versions":["3.4.13"],"available":[{"date":"2026-10-22","kind":"first-observed","version":"3.4.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113730","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113730","date":"2026-10-27","epss":0.00394,"percentile":0.33458}],"risk":0.20882,"urls":["https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m","https://nvd.nist.gov/vuln/detail/CVE-2026-113730","https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d","https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crwc-vw2r-qr6m","description":"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies"},"relatedVulnerabilities":[{"id":"CVE-2026-113730","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113730","cwe":"CWE-693","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-113730","date":"2026-10-27","epss":0.00394,"percentile":0.33458}],"urls":["https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d","https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2","https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13","https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113730","description":"OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13."}]},{"artifact":{"id":"9d8d77aaa7562a98","cpes":["cpe:2.3:a:apache:shiro-spring:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_spring:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:spring:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-spring","purl":"pkg:maven/org.apache.shiro/shiro-spring@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-spring-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-spring","archiveDigests":[{"value":"e9fc4c29045a67cf985ec9f0da3eac651f153624","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-spring-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c244-p6m5-vqj6","versionConstraint":"<=2.0.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-spring","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c244-p6m5-vqj6","fix":{"state":"fixed","versions":["2.1.0"],"available":[{"date":"2026-03-04","kind":"first-observed","version":"2.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23903","cwe":"CWE-289","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23903","date":"2026-10-27","epss":0.00402,"percentile":0.34302}],"risk":0.20703000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-23903","https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k","http://www.openwall.com/lists/oss-security/2026/02/08/1","https://github.com/apache/shiro/commit/3b9638b957495004599aeaf24ba8949e309f26e8"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c244-p6m5-vqj6","description":"Apache Shiro has an Authentication Bypass"},"relatedVulnerabilities":[{"id":"CVE-2026-23903","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23903","cwe":"CWE-289","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23903","date":"2026-10-27","epss":0.00402,"percentile":0.34302}],"urls":["https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k","http://www.openwall.com/lists/oss-security/2026/02/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23903","description":"Authentication Bypass by Alternate Name vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7, which fixes the issue.\n\nThe issue only effects static files. If static files are served from a case-insensitive filesystem,\nsuch as default macOS setup, static files may be accessed by varying the case of the filename in the request.\nIf only lower-case (common default) filters are present in Shiro, they may be bypassed this way.\n\nShiro 2.1.0 and later has a new parameters to remediate this issue\nshiro.ini: filterChainResolver.caseInsensitive = true\napplication.properties: shiro.caseInsensitive=true\n\nShiro 3.0.0 and later makes this the default in shiro.ini-based configurations.\nShiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rcqc-6cw3-h962","versionConstraint":">=2.21.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rcqc-6cw3-h962","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54518","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54518","date":"2026-10-27","epss":0.00354,"percentile":0.28958}],"risk":0.20355,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962","https://github.com/FasterXML/jackson-databind/pull/5971","https://github.com/FasterXML/jackson-databind/pull/5973","https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341","https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea","https://nvd.nist.gov/vuln/detail/CVE-2026-54518"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rcqc-6cw3-h962","description":"jackson-databind has a @JsonView bypass for unwrapped creator parameters"},"relatedVulnerabilities":[{"id":"CVE-2026-54518","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54518","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54518","date":"2026-10-27","epss":0.00354,"percentile":0.28958}],"urls":["https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341","https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea","https://github.com/FasterXML/jackson-databind/pull/5971","https://github.com/FasterXML/jackson-databind/pull/5973","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54518","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4."}]},{"artifact":{"id":"225fe840083bdd83","cpes":["cpe:2.3:a:org.springframework:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:6.2.17:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@6.2.17","type":"java-archive","version":"6.2.17","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-expression-6.2.17.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"d2f104d59e9a2d70c7f55c50c79417a63a24ad86","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-expression-6.2.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wxpp-56q6-5pcg","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"6.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wxpp-56q6-5pcg","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-30","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41851","cwe":"CWE-770","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41851","date":"2026-10-27","epss":0.00387,"percentile":0.32587}],"risk":0.199305,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41851","https://spring.io/security/cve-2026-41851","https://github.com/spring-projects/spring-framework/commit/2c18c33ce0f89bf718c184190cfb7ed49b4276fb","https://github.com/spring-projects/spring-framework/commit/76a36dfd707cddbe7118a81c2e055b36501d2cff","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wxpp-56q6-5pcg","description":"Spring Framework Denial of Service via Unbounded Cache in SpEL"},"relatedVulnerabilities":[{"id":"CVE-2026-41851","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41851","cwe":"CWE-770","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41851","date":"2026-10-27","epss":0.00387,"percentile":0.32587}],"urls":["https://spring.io/security/cve-2026-41851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41851","description":"Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5gvw-p9qm-jgwh","versionConstraint":">=2.19.0,<2.21.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5gvw-p9qm-jgwh","fix":{"state":"fixed","versions":["2.21.5"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.21.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-27","epss":0.00346,"percentile":0.27994}],"risk":0.19895,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","https://nvd.nist.gov/vuln/detail/CVE-2026-59889","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","description":"jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-59889","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59889","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59889","date":"2026-10-27","epss":0.00346,"percentile":0.27994}],"urls":["https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","https://github.com/FasterXML/jackson-databind/issues/6060","https://github.com/FasterXML/jackson-databind/pull/6056","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5hh8-q8hv-fr38","versionConstraint":">=2.21.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5hh8-q8hv-fr38","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54517","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54517","date":"2026-10-27","epss":0.00384,"percentile":0.32296}],"risk":0.19776,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38","https://github.com/FasterXML/jackson-databind/pull/5969","https://github.com/FasterXML/jackson-databind/pull/5970","https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d","https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962","https://nvd.nist.gov/vuln/detail/CVE-2026-54517"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5hh8-q8hv-fr38","description":"jackson-databind has @JsonView bypass for setterless creator properties"},"relatedVulnerabilities":[{"id":"CVE-2026-54517","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54517","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54517","date":"2026-10-27","epss":0.00384,"percentile":0.32296}],"urls":["https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d","https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962","https://github.com/FasterXML/jackson-databind/pull/5969","https://github.com/FasterXML/jackson-databind/pull/5970","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54517","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4."}]},{"artifact":{"id":"1f4e62e797862c40","cpes":["cpe:2.3:a:io.netty.codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http2:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http2:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http2:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http2","archiveDigests":[{"value":"ce03862f1ce5e4bd5a8af688ac9f5146a8192867","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http2-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5x3r-wrvg-rp6q","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http2","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5x3r-wrvg-rp6q","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47244","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47244","date":"2026-10-27","epss":0.00384,"percentile":0.32276}],"risk":0.19776,"urls":["https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-47244"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5x3r-wrvg-rp6q","description":"Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced"},"relatedVulnerabilities":[{"id":"CVE-2026-47244","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47244","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-47244","date":"2026-10-27","epss":0.00384,"percentile":0.32276}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47244","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgj6-7826-r7m5","versionConstraint":">=2.19.0,<2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hgj6-7826-r7m5","fix":{"state":"fixed","versions":["2.21.4"],"available":[{"date":"2026-06-24","kind":"first-observed","version":"2.21.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-27","epss":0.00368,"percentile":0.30475}],"risk":0.18952000000000002,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://nvd.nist.gov/vuln/detail/CVE-2026-54514"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","description":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"},"relatedVulnerabilities":[{"id":"CVE-2026-54514","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54514","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-54514","date":"2026-10-27","epss":0.00368,"percentile":0.30475}],"urls":["https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","https://github.com/FasterXML/jackson-databind/pull/5951","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4."}]},{"artifact":{"id":"ab6111989cd6a50c","cpes":["cpe:2.3:a:io.netty.resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver_dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver-dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver_dns:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:resolver:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver-dns:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:resolver_dns:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-resolver-dns","purl":"pkg:maven/io.netty/netty-resolver-dns@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-resolver-dns","archiveDigests":[{"value":"7424b52366c642e833e4cd5846c6ef07d05eb5c2","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-resolver-dns-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xmv7-r254-6q78","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-resolver-dns","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xmv7-r254-6q78","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45673","cwe":"CWE-330","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45673","cwe":"CWE-340","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45673","date":"2026-10-27","epss":0.0032,"percentile":0.24876}],"risk":0.1888,"urls":["https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45673"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xmv7-r254-6q78","description":"Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port"},"relatedVulnerabilities":[{"id":"CVE-2026-45673","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45673","cwe":"CWE-330","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45673","cwe":"CWE-340","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45673","date":"2026-10-27","epss":0.0032,"percentile":0.24876}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45673","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.17.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c42-7qj2-3j46","versionConstraint":">=4.2.0.Final,<=4.2.16.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c42-7qj2-3j46","fix":{"state":"fixed","versions":["4.2.17.Final"],"available":[{"date":"2026-08-18","kind":"first-observed","version":"4.2.17.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-27","epss":0.00324,"percentile":0.25235}],"risk":0.1863,"urls":["https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","description":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite"},"relatedVulnerabilities":[{"id":"CVE-2026-59903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-59903","cwe":"CWE-524","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-59903","date":"2026-10-27","epss":0.00324,"percentile":0.25235}],"urls":["https://github.com/netty/netty/pull/17213","https://github.com/netty/netty/pull/17217","https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-61308","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-61308","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-27","epss":0.0031,"percentile":0.23688}],"risk":0.18289999999999998,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61308","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-27","epss":0.00312,"percentile":0.23948}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-27","epss":0.00312,"percentile":0.23948}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-27","epss":0.00312,"percentile":0.23948}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"49754a0ebaeedf0d","cpes":["cpe:2.3:a:org.eclipse.jetty.util:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.util:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.util:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty.util:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse-jetty-project:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse_jetty_project:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty-util:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty_util:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:util:jetty-util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:util:jetty_util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:jetty:util:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:util:jetty:12.0.33:*:*:*:*:*:*:*","cpe:2.3:a:util:util:12.0.33:*:*:*:*:*:*:*"],"name":"jetty-util","purl":"pkg:maven/org.eclipse.jetty/jetty-util@12.0.33","type":"java-archive","version":"12.0.33","language":"java","licenses":["https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jetty-util-12.0.33.jar","manifestName":"","pomArtifactID":"jetty-util","archiveDigests":[{"value":"9ff0e88aca4dd2247217c0cb68ced168fd8a729b","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jetty-util-12.0.33.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"12.0.35"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w7x5-g22v-xqhr","versionConstraint":">=12.0.0,<=12.0.34 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-util","version":"12.0.33"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w7x5-g22v-xqhr","fix":{"state":"fixed","versions":["12.0.35"],"available":[{"date":"2026-07-23","kind":"first-observed","version":"12.0.35"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8384","cwe":"CWE-647","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-8384","date":"2026-10-27","epss":0.0033,"percentile":0.26028}],"risk":0.16995000000000002,"urls":["https://github.com/jetty/jetty.project/security/advisories/GHSA-w7x5-g22v-xqhr","https://nvd.nist.gov/vuln/detail/CVE-2026-8384","https://github.com/jetty/jetty.project/pull/14969","https://github.com/jetty/jetty.project/pull/14973","https://github.com/jetty/jetty.project/commit/82969c77f6da46e27008b10b3c14840cd31db084","https://github.com/jetty/jetty.project/commit/ade27ce93a37c33278720250d85c48601230ae3f","https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.35","https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.9","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w7x5-g22v-xqhr","description":"Eclipse Jetty: Path parameter traversal"},"relatedVulnerabilities":[{"id":"CVE-2026-8384","cvss":[{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8384","cwe":"CWE-647","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2026-8384","date":"2026-10-27","epss":0.0033,"percentile":0.26028}],"urls":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v8h7-rr48-vmmv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v8h7-rr48-vmmv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-06","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41417","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41417","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41417","date":"2026-10-27","epss":0.00318,"percentile":0.24625}],"risk":0.16377000000000003,"urls":["https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv","https://nvd.nist.gov/vuln/detail/CVE-2026-41417"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v8h7-rr48-vmmv","description":"Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection"},"relatedVulnerabilities":[{"id":"CVE-2026-41417","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41417","cwe":"CWE-93","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41417","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41417","date":"2026-10-27","epss":0.00318,"percentile":0.24625}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41417","description":"Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvgp-rfg2-7rr6","versionConstraint":">=2.19.0,<2.21.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vvgp-rfg2-7rr6","fix":{"state":"fixed","versions":["2.21.5"],"available":[{"date":"2026-09-29","kind":"first-observed","version":"2.21.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-27","epss":0.00313,"percentile":0.24018}],"risk":0.161195,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","https://nvd.nist.gov/vuln/detail/CVE-2026-77310","https://github.com/FasterXML/jackson-databind/pull/6058","https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5","https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","description":"jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization"},"relatedVulnerabilities":[{"id":"CVE-2026-77310","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77310","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-77310","date":"2026-10-27","epss":0.00313,"percentile":0.24018}],"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1."}]},{"artifact":{"id":"1b70f1a64a3a5207","cpes":["cpe:2.3:a:spring-security-saml2-service-provider:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-saml2-service-provider","purl":"pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-saml2-service-provider","archiveDigests":[{"value":"e3c202a32f607cae7909508c9c4b377dd382132c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3pjj-qpw6-5fcm","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-saml2-service-provider","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3pjj-qpw6-5fcm","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-13","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41003","cwe":"CWE-79","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41003","date":"2026-10-27","epss":0.00204,"percentile":0.10233}],"risk":0.15402,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41003","https://spring.io/security/cve-2026-41003","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3pjj-qpw6-5fcm","description":"Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters"},"relatedVulnerabilities":[{"id":"CVE-2026-41003","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41003","cwe":"CWE-79","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41003","date":"2026-10-27","epss":0.00204,"percentile":0.10233}],"urls":["https://spring.io/security/cve-2026-41003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41003","description":"An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.13.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-38f8-5428-x5cv","versionConstraint":">=4.2.0.Alpha1,<=4.2.12.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-38f8-5428-x5cv","fix":{"state":"fixed","versions":["4.2.13.Final"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"4.2.13.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42585","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42585","date":"2026-10-27","epss":0.00267,"percentile":0.18714}],"risk":0.153525,"urls":["https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length","https://nvd.nist.gov/vuln/detail/CVE-2026-42585"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-38f8-5428-x5cv","description":"Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding"},"relatedVulnerabilities":[{"id":"CVE-2026-42585","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42585","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-42585","date":"2026-10-27","epss":0.00267,"percentile":0.18714}],"urls":["https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."}]},{"artifact":{"id":"b14de04eccdf9a10","cpes":["cpe:2.3:a:apache:shiro-web:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_web:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:web:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-web","purl":"pkg:maven/org.apache.shiro/shiro-web@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-web-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-web","archiveDigests":[{"value":"99a09dc19f37487639b5bab978953bc38963d6ea","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-web-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c6r4-qjmw-cvj2","versionConstraint":">=1.0.0-incubating,<2.2.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-web","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c6r4-qjmw-cvj2","fix":{"state":"fixed","versions":["2.2.0"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"2.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43828","cwe":"CWE-614","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43828","date":"2026-10-27","epss":0.00272,"percentile":0.19454}],"risk":0.14824000000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-43828","https://shiro.apache.org/security-reports.html#cve_2026_43828","http://www.openwall.com/lists/oss-security/2026/05/25/7"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c6r4-qjmw-cvj2","description":"Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute"},"relatedVulnerabilities":[{"id":"CVE-2026-43828","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-43828","cwe":"CWE-614","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-43828","date":"2026-10-27","epss":0.00272,"percentile":0.19454}],"urls":["https://shiro.apache.org/security-reports.html#cve_2026_43828","http://www.openwall.com/lists/oss-security/2026/05/25/7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-43828","description":"Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.\n\n\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default."}]},{"artifact":{"id":"3ce5c3eae6e0bb05","cpes":["cpe:2.3:a:jonathan-hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jonathan_hedley:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:org.jsoup:jsoup:1.15.3:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.15.3","type":"java-archive","version":"1.15.3","language":"java","licenses":["https://jsoup.org/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"f6e1d8a8819f854b681c8eaa57fd59a42329e10c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jsoup-1.15.3.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.23.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pmhh-3w7g-xqp8","versionConstraint":">=1.14.3,<1.23.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.15.3"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-pmhh-3w7g-xqp8","fix":{"state":"fixed","versions":["1.23.1"],"available":[{"date":"2026-08-07","kind":"first-observed","version":"1.23.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71497","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71497","date":"2026-10-27","epss":0.00296,"percentile":0.22085}],"risk":0.14356,"urls":["https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8","https://github.com/jhy/jsoup/issues/2538","https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pmhh-3w7g-xqp8","description":"jsoup: Cleaner may expose markup with custom raw-text elements"},"relatedVulnerabilities":[{"id":"CVE-2026-71497","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-71497","cwe":"CWE-79","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-71497","date":"2026-10-27","epss":0.00296,"percentile":0.22085}],"urls":["https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70","https://github.com/jhy/jsoup/issues/2538","https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1","https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71497","description":"jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-70907","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-70907","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-27","epss":0.00278,"percentile":0.201}],"risk":0.14317,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70907","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"08a5e1eb6d800c3c","cpes":["cpe:2.3:a:io.netty.codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec-http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec_http:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:codec:codec_http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec-http:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:codec_http:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","manifestName":"","pomArtifactID":"netty-codec-http","archiveDigests":[{"value":"93e6b3df76177423742ed10d48612b59e46f0c8c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-codec-http-4.2.10.Final.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hvcg-qmg6-jm4c","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-codec-http","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hvcg-qmg6-jm4c","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-16","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50020","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50020","date":"2026-10-27","epss":0.00232,"percentile":0.14044}],"risk":0.11948,"urls":["https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c","https://nvd.nist.gov/vuln/detail/CVE-2026-50020","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hvcg-qmg6-jm4c","description":"Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted"},"relatedVulnerabilities":[{"id":"CVE-2026-50020","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50020","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50020","date":"2026-10-27","epss":0.00232,"percentile":0.14044}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"f0ddb36af4d47754","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-web-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"9fd9dfc9f68dca28089179bb27ba24bfb5b49801","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-web-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x2r2-rvhq-2mqv","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x2r2-rvhq-2mqv","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-12","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41706","cwe":"CWE-601","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41706","date":"2026-10-27","epss":0.00211,"percentile":0.11253}],"risk":0.11710499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41706","https://spring.io/security/cve-2026-41706","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x2r2-rvhq-2mqv","description":"Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache"},"relatedVulnerabilities":[{"id":"CVE-2026-41706","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41706","cwe":"CWE-601","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41706","date":"2026-10-27","epss":0.00211,"percentile":0.11253}],"urls":["https://spring.io/security/cve-2026-41706"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41706","description":"Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"522825f75c34d875","cpes":["cpe:2.3:a:springsource-spring-framework:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:vmware:springsource_spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_framework:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-core:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_core:6.2.17:*:*:*:*:*:*:*"],"name":"spring-core","purl":"pkg:maven/org.springframework/spring-core@6.2.17","type":"java-archive","version":"6.2.17","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-core-6.2.17.jar","manifestName":"","pomArtifactID":"spring-core","archiveDigests":[{"value":"30e3c17a0df9fab46363a9c2c5a65a997b88fab3","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-core-6.2.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-659m-px2c-25wj","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-core","version":"6.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-659m-px2c-25wj","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-31","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41848","cwe":"CWE-1333","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41848","date":"2026-10-27","epss":0.00335,"percentile":0.26715}],"risk":0.11222499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41848","https://spring.io/security/cve-2026-41848","https://github.com/spring-projects/spring-framework/commit/12b44f2545a1bec6150c7a05e66092c732597a94","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-659m-px2c-25wj","description":"Spring Framework Denial of Service via AntPathMatcher"},"relatedVulnerabilities":[{"id":"CVE-2026-41848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41848","cwe":"CWE-1333","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41848","date":"2026-10-27","epss":0.00335,"percentile":0.26715}],"urls":["https://spring.io/security/cve-2026-41848"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41848","description":"Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"2da8cae68887fec2","cpes":["cpe:2.3:a:logback-core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback_core:1.5.19:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.5.19","type":"java-archive","version":"1.5.19","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"8847d9fcb02c62c338ba26e2b28059dd585ea1a9","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5.34"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jhq6-gfmj-v8fx","versionConstraint":"<1.5.34 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.5.19"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jhq6-gfmj-v8fx","fix":{"state":"fixed","versions":["1.5.34"],"available":[{"date":"2026-07-16","kind":"first-observed","version":"1.5.34"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:M/U:Green","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10532","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-10532","date":"2026-10-27","epss":0.0037,"percentile":0.30742}],"risk":0.10915,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-10532","https://logback.qos.ch/news.html#1.5.34","https://github.com/qos-ch/logback/releases/tag/v_1.5.34"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jhq6-gfmj-v8fx","description":"Logback vulnerable to Object Injection through HardenedObjectInputStream modules"},"relatedVulnerabilities":[{"id":"CVE-2026-10532","cvss":[{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10532","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-10532","date":"2026-10-27","epss":0.0037,"percentile":0.30742}],"urls":["https://logback.qos.ch/news.html#1.5.34"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10532","description":"Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.33 inclusive."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56109","versionConstraint":"< 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56109","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.8,"impactScore":4.3,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56109","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-56109","date":"2026-10-27","epss":0.00138,"percentile":0.03179}],"risk":0.09935999999999999,"urls":["https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read."},"relatedVulnerabilities":[]},{"artifact":{"id":"ca159fa7cf405180","cpes":["cpe:2.3:a:org.springframework.boot:spring-boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:spring_boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring-boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring_boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring-boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring_boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:springframework:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring-boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring_boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:boot:boot:3.5.12:*:*:*:*:*:*:*"],"name":"spring-boot","purl":"pkg:maven/org.springframework.boot/spring-boot@3.5.12","type":"java-archive","version":"3.5.12","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.boot","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-boot-3.5.12.jar","manifestName":"","pomArtifactID":"spring-boot","archiveDigests":[{"value":"da8301111d026baad823ca00e19b636bc5ef0699","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-boot-3.5.12.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wwpq-f5c3-7hvx","versionConstraint":">=3.5.0,<3.5.14 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.boot:spring-boot","version":"3.5.12"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wwpq-f5c3-7hvx","fix":{"state":"fixed","versions":["3.5.14"],"available":[{"date":"2026-05-07","kind":"first-observed","version":"3.5.14"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40973","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40973","date":"2026-10-27","epss":0.00136,"percentile":0.02991}],"risk":0.09860000000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-40973","https://spring.io/security/cve-2026-40973"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wwpq-f5c3-7hvx","description":"Spring Boot accepts predictable temp directory without ownership verification"},"relatedVulnerabilities":[{"id":"CVE-2026-40973","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40973","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-40973","date":"2026-10-27","epss":0.00136,"percentile":0.02991}],"urls":["https://spring.io/security/cve-2026-40973"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40973","description":"A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory."}]},{"artifact":{"id":"d4ab3efc304a4e30","cpes":["cpe:2.3:a:openjdk21:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk21:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk21:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:openjdk:21.0.12_p8-r0:*:*:*:*:*:*:*"],"name":"openjdk21","purl":"pkg:apk/alpine/openjdk21@21.0.12_p8-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"21.0.12_p8-r0","language":"","licenses":["GPL-2.0-with-classpath-exception"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/jvm"},{"path":"/usr/lib/jvm/java-21-openjdk"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openjdk21"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-60589","versionConstraint":"< 1.8.0_504||>= 1.9, < 8.0.504||>= 12, < 17.0.20.1||>= 18, < 21.0.12.1||>= 22, < 25.0.4.1||>= 26, < 26.0.2.1||>= 9, < 11.0.32.1 (jvm)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:openjdk:21.0.12_p8:*:*:*:*:*:*:*"],"package":{"name":"openjdk21","version":"21.0.12_p8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-60589","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-27","epss":0.00265,"percentile":0.18328}],"risk":0.08877499999999999,"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60589","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-90781","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-27","epss":0.00179,"percentile":0.07423}],"risk":0.08592,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[]},{"artifact":{"id":"f0ddb36af4d47754","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-web-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"9fd9dfc9f68dca28089179bb27ba24bfb5b49801","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-web-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-293q-567p-wmwq","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-293q-567p-wmwq","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-07-01","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47838","cwe":"CWE-287","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-47838","date":"2026-10-27","epss":0.00133,"percentile":0.02782}],"risk":0.07847,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-47838","https://spring.io/security/cve-2026-47838","https://github.com/advisories/GHSA-2jrg-rf5x-568g"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-293q-567p-wmwq","description":"Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates"},"relatedVulnerabilities":[{"id":"CVE-2026-47838","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47838","cwe":"CWE-287","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-47838","date":"2026-10-27","epss":0.00133,"percentile":0.02782}],"urls":["https://spring.io/security/cve-2026-47838"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47838","description":"SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10."}]},{"artifact":{"id":"2da8cae68887fec2","cpes":["cpe:2.3:a:logback-core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback_core:1.5.19:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.5.19","type":"java-archive","version":"1.5.19","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"8847d9fcb02c62c338ba26e2b28059dd585ea1a9","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5.33"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p47f-322f-whfh","versionConstraint":"<=1.5.32 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.5.19"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p47f-322f-whfh","fix":{"state":"fixed","versions":["1.5.33"],"available":[{"date":"2026-07-02","kind":"first-observed","version":"1.5.33"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:L/U:Green","metrics":{"baseScore":1.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9828","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-9828","date":"2026-10-27","epss":0.0037,"percentile":0.30702}],"risk":0.0777,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9828","https://logback.qos.ch/news.html#1.5.33"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p47f-322f-whfh","description":"QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-9828","cvss":[{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Green","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9828","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-9828","date":"2026-10-27","epss":0.0037,"percentile":0.30702}],"urls":["https://logback.qos.ch/news.html#1.5.33"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9828","description":"Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate objects from\n classes in the java.lang and java.util packages that are not explicitly\n blocked.\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.32 inclusive."}]},{"artifact":{"id":"7f9557fee8eec2e6","cpes":["cpe:2.3:a:org.springframework.security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-core","purl":"pkg:maven/org.springframework.security/spring-security-core@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-core-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-core","archiveDigests":[{"value":"a9c374607e9f8593c28dbb93feb4ef1ee32aa527","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-core-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vxf7-qj7q-83fh","versionConstraint":">=6.5.0,<=6.5.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-core","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vxf7-qj7q-83fh","fix":{"state":"fixed","versions":["6.5.10"],"available":[{"date":"2026-04-30","kind":"first-observed","version":"6.5.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22746","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22746","date":"2026-10-27","epss":0.00215,"percentile":0.11844}],"risk":0.07202499999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-22746","https://spring.io/security/cve-2026-22746"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vxf7-qj7q-83fh","description":"Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider"},"relatedVulnerabilities":[{"id":"CVE-2026-22746","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22746","cwe":"CWE-208","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22746","date":"2026-10-27","epss":0.00215,"percentile":0.11844}],"urls":["https://spring.io/security/cve-2026-22746"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22746","description":"Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18508","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-10-27","epss":0.00141,"percentile":0.03396}],"risk":0.06627,"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."},"relatedVulnerabilities":[]},{"artifact":{"id":"a3ebb83c8dcde376","cpes":["cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-epoll.linux-x86_64:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-epoll:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_epoll:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-epoll:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_epoll:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86-64:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86_64:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86_64:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux-x86:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux_x86:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:linux:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport-native-epoll:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport_native_epoll:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-transport-native-epoll","purl":"pkg:maven/io.netty/netty-transport-native-epoll@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-transport-native-epoll-4.2.10.Final-linux-x86_64.jar","manifestName":"","pomArtifactID":"netty-transport-native-epoll","archiveDigests":[{"value":"e629961393a508daab9480f6f2ae7b79deb5ea66","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-transport-native-epoll-4.2.10.Final-linux-x86_64.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w573-9ffj-6ff9","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-transport-native-epoll","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w573-9ffj-6ff9","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-27","epss":0.00136,"percentile":0.02992}],"risk":0.061200000000000004,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45536"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w573-9ffj-6ff9","description":"Netty: Unix-socket fd receive leaks descriptors when peer sends two at once"},"relatedVulnerabilities":[{"id":"CVE-2026-45536","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-27","epss":0.00136,"percentile":0.02992}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45536","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"1be0be0f022ee1a4","cpes":["cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty.transport-native-kqueue.osx-x86_64:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native-kqueue:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native_kqueue:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native-kqueue:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native_kqueue:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport-native:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport_native:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport-native:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport_native:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-transport:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_transport:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty-project:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty_project:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86-64:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86_64:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86_64:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:netty-transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:netty_transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:transport:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:io.netty:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx-x86:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx_x86:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:netty:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:transport-native-kqueue:4.2.10.Final:*:*:*:*:*:*:*","cpe:2.3:a:osx:transport_native_kqueue:4.2.10.Final:*:*:*:*:*:*:*"],"name":"netty-transport-native-kqueue","purl":"pkg:maven/io.netty/netty-transport-native-kqueue@4.2.10.Final","type":"java-archive","version":"4.2.10.Final","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"io.netty","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-transport-native-kqueue-4.2.10.Final-osx-x86_64.jar","manifestName":"","pomArtifactID":"netty-transport-native-kqueue","archiveDigests":[{"value":"30988cb6627dffb2066f3401314d957ff427b054","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/netty-transport-native-kqueue-4.2.10.Final-osx-x86_64.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.15.Final"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w573-9ffj-6ff9","versionConstraint":">=4.2.0.Final,<=4.2.14.Final (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"io.netty:netty-transport-native-kqueue","version":"4.2.10.Final"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w573-9ffj-6ff9","fix":{"state":"fixed","versions":["4.2.15.Final"],"available":[{"date":"2026-06-09","kind":"first-observed","version":"4.2.15.Final"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-27","epss":0.00136,"percentile":0.02992}],"risk":0.061200000000000004,"urls":["https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://nvd.nist.gov/vuln/detail/CVE-2026-45536"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w573-9ffj-6ff9","description":"Netty: Unix-socket fd receive leaks descriptors when peer sends two at once"},"relatedVulnerabilities":[{"id":"CVE-2026-45536","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45536","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-45536","cwe":"CWE-772","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-45536","date":"2026-10-27","epss":0.00136,"percentile":0.02992}],"urls":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45536","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue."}]},{"artifact":{"id":"7f9557fee8eec2e6","cpes":["cpe:2.3:a:org.springframework.security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-security-core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security_core:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:vmware:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-core","purl":"pkg:maven/org.springframework.security/spring-security-core@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-core-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-core","archiveDigests":[{"value":"a9c374607e9f8593c28dbb93feb4ef1ee32aa527","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-core-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-x2wq-9x2f-fhj7","versionConstraint":">=6.5.0,<6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-core","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-x2wq-9x2f-fhj7","fix":{"state":"fixed","versions":["6.5.10"],"available":[{"date":"2026-04-26","kind":"first-observed","version":"6.5.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22751","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22751","date":"2026-10-27","epss":0.00124,"percentile":0.02158}],"risk":0.06076,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-22751","https://spring.io/security/cve-2026-22751","https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047","https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261","https://jinyeong.seol.pro/blogs/cve-2026-22751/en"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x2wq-9x2f-fhj7","description":"Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured"},"relatedVulnerabilities":[{"id":"CVE-2026-22751","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22751","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-22751","date":"2026-10-27","epss":0.00124,"percentile":0.02158}],"urls":["https://spring.io/security/cve-2026-22751"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22751","description":"Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4."}]},{"artifact":{"id":"225fe840083bdd83","cpes":["cpe:2.3:a:org.springframework:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:6.2.17:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@6.2.17","type":"java-archive","version":"6.2.17","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-expression-6.2.17.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"d2f104d59e9a2d70c7f55c50c79417a63a24ad86","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-expression-6.2.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9f52-rjqv-25qv","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"6.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9f52-rjqv-25qv","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-07-31","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41852","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41852","date":"2026-10-27","epss":0.00177,"percentile":0.07235}],"risk":0.059294999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41852","https://spring.io/security/cve-2026-41852","https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9f52-rjqv-25qv","description":"Spring Framework Arbitrary Method Invocation in SpEL Expressions"},"relatedVulnerabilities":[{"id":"CVE-2026-41852","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41852","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41852","date":"2026-10-27","epss":0.00177,"percentile":0.07235}],"urls":["https://spring.io/security/cve-2026-41852"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41852","description":"A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48."}]},{"artifact":{"id":"64eeca67092cc090","cpes":["cpe:2.3:a:org.springframework:spring-web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:6.2.17:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:6.2.17:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@6.2.17","type":"java-archive","version":"6.2.17","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-web-6.2.17.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"7ff3be531a63850bb91d31aaeada0578e96a0fec","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-web-6.2.17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7m2p-62gw-p8qq","versionConstraint":">=6.2.0,<=6.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"6.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7m2p-62gw-p8qq","fix":{"state":"fixed","versions":["6.2.19"],"available":[{"date":"2026-08-07","kind":"first-observed","version":"6.2.19"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41854","cwe":"CWE-918","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41854","date":"2026-10-27","epss":0.00123,"percentile":0.02063}],"risk":0.05658,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41854","https://spring.io/security/cve-2026-41854"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7m2p-62gw-p8qq","description":"Spring Framework Server-Side Request Forgery via UriComponentsBuilder"},"relatedVulnerabilities":[{"id":"CVE-2026-41854","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41854","cwe":"CWE-918","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41854","date":"2026-10-27","epss":0.00123,"percentile":0.02063}],"urls":["https://spring.io/security/cve-2026-41854"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41854","description":"Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18."}]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96674","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96674","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96674","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96674","date":"2026-10-27","epss":0.00115,"percentile":0.01548}],"risk":0.0552,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96674","description":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fa2a8d27b3bb32ed","cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_project:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa-lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa_lib:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa-lib:1.2.15.3-r0:*:*:*:*:*:*:*","cpe:2.3:a:alsa:alsa_lib:1.2.15.3-r0:*:*:*:*:*:*:*"],"name":"alsa-lib","purl":"pkg:apk/alpine/alsa-lib@1.2.15.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.2.15.3-r0","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/alsa"},{"path":"/etc/alsa/conf.d"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/aserver"},{"path":"/usr/lib"},{"path":"/usr/lib/libasound.so.2"},{"path":"/usr/lib/libasound.so.2.0.0"},{"path":"/usr/lib/libatopology.so.2"},{"path":"/usr/lib/libatopology.so.2.0.0"},{"path":"/usr/share"},{"path":"/usr/share/alsa"},{"path":"/usr/share/alsa/alsa.conf"},{"path":"/usr/share/alsa/cards"},{"path":"/usr/share/alsa/cards/AACI.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-MODEM.conf"},{"path":"/usr/share/alsa/cards/ATIIXP-SPDMA.conf"},{"path":"/usr/share/alsa/cards/ATIIXP.conf"},{"path":"/usr/share/alsa/cards/AU8810.conf"},{"path":"/usr/share/alsa/cards/AU8820.conf"},{"path":"/usr/share/alsa/cards/AU8830.conf"},{"path":"/usr/share/alsa/cards/Audigy.conf"},{"path":"/usr/share/alsa/cards/Audigy2.conf"},{"path":"/usr/share/alsa/cards/Aureon51.conf"},{"path":"/usr/share/alsa/cards/Aureon71.conf"},{"path":"/usr/share/alsa/cards/CA0106.conf"},{"path":"/usr/share/alsa/cards/CMI8338-SWIEC.conf"},{"path":"/usr/share/alsa/cards/CMI8338.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC6.conf"},{"path":"/usr/share/alsa/cards/CMI8738-MC8.conf"},{"path":"/usr/share/alsa/cards/CMI8788.conf"},{"path":"/usr/share/alsa/cards/CS46xx.conf"},{"path":"/usr/share/alsa/cards/EMU10K1.conf"},{"path":"/usr/share/alsa/cards/EMU10K1X.conf"},{"path":"/usr/share/alsa/cards/ENS1370.conf"},{"path":"/usr/share/alsa/cards/ENS1371.conf"},{"path":"/usr/share/alsa/cards/ES1968.conf"},{"path":"/usr/share/alsa/cards/Echo_Echo3G.conf"},{"path":"/usr/share/alsa/cards/FM801.conf"},{"path":"/usr/share/alsa/cards/FWSpeakers.conf"},{"path":"/usr/share/alsa/cards/FireWave.conf"},{"path":"/usr/share/alsa/cards/GUS.conf"},{"path":"/usr/share/alsa/cards/HDA-Intel.conf"},{"path":"/usr/share/alsa/cards/HdmiLpeAudio.conf"},{"path":"/usr/share/alsa/cards/ICE1712.conf"},{"path":"/usr/share/alsa/cards/ICE1724.conf"},{"path":"/usr/share/alsa/cards/ICH-MODEM.conf"},{"path":"/usr/share/alsa/cards/ICH.conf"},{"path":"/usr/share/alsa/cards/ICH4.conf"},{"path":"/usr/share/alsa/cards/Loopback.conf"},{"path":"/usr/share/alsa/cards/Maestro3.conf"},{"path":"/usr/share/alsa/cards/NFORCE.conf"},{"path":"/usr/share/alsa/cards/PC-Speaker.conf"},{"path":"/usr/share/alsa/cards/PMac.conf"},{"path":"/usr/share/alsa/cards/PMacToonie.conf"},{"path":"/usr/share/alsa/cards/PS3.conf"},{"path":"/usr/share/alsa/cards/RME9636.conf"},{"path":"/usr/share/alsa/cards/RME9652.conf"},{"path":"/usr/share/alsa/cards/SB-XFi.conf"},{"path":"/usr/share/alsa/cards/SI7018.conf"},{"path":"/usr/share/alsa/cards/TRID4DWAVENX.conf"},{"path":"/usr/share/alsa/cards/USB-Audio.conf"},{"path":"/usr/share/alsa/cards/VIA686A.conf"},{"path":"/usr/share/alsa/cards/VIA8233.conf"},{"path":"/usr/share/alsa/cards/VIA8233A.conf"},{"path":"/usr/share/alsa/cards/VIA8237.conf"},{"path":"/usr/share/alsa/cards/VX222.conf"},{"path":"/usr/share/alsa/cards/VXPocket.conf"},{"path":"/usr/share/alsa/cards/VXPocket440.conf"},{"path":"/usr/share/alsa/cards/YMF744.conf"},{"path":"/usr/share/alsa/cards/aliases.conf"},{"path":"/usr/share/alsa/cards/pistachio-card.conf"},{"path":"/usr/share/alsa/cards/vc4-hdmi.conf"},{"path":"/usr/share/alsa/ctl"},{"path":"/usr/share/alsa/ctl/default.conf"},{"path":"/usr/share/alsa/pcm"},{"path":"/usr/share/alsa/pcm/center_lfe.conf"},{"path":"/usr/share/alsa/pcm/default.conf"},{"path":"/usr/share/alsa/pcm/dmix.conf"},{"path":"/usr/share/alsa/pcm/dpl.conf"},{"path":"/usr/share/alsa/pcm/dsnoop.conf"},{"path":"/usr/share/alsa/pcm/front.conf"},{"path":"/usr/share/alsa/pcm/hdmi.conf"},{"path":"/usr/share/alsa/pcm/iec958.conf"},{"path":"/usr/share/alsa/pcm/modem.conf"},{"path":"/usr/share/alsa/pcm/rear.conf"},{"path":"/usr/share/alsa/pcm/side.conf"},{"path":"/usr/share/alsa/pcm/surround21.conf"},{"path":"/usr/share/alsa/pcm/surround40.conf"},{"path":"/usr/share/alsa/pcm/surround41.conf"},{"path":"/usr/share/alsa/pcm/surround50.conf"},{"path":"/usr/share/alsa/pcm/surround51.conf"},{"path":"/usr/share/alsa/pcm/surround71.conf"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"alsa-lib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-96675","versionConstraint":"<= 1.2.16.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:alsa-project:alsa-lib:1.2.15.3:*:*:*:*:*:*:*"],"package":{"name":"alsa-lib","version":"1.2.15.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-96675","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-96675","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-96675","date":"2026-10-27","epss":0.00111,"percentile":0.01297}],"risk":0.05022750000000001,"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","https://github.com/alsa-project/alsa-lib/pull/527","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-96675","description":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."},"relatedVulnerabilities":[]},{"artifact":{"id":"1b70f1a64a3a5207","cpes":["cpe:2.3:a:spring-security-saml2-service-provider:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service-provider:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service_provider:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-saml2-service-provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_saml2_service_provider:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2-service:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2_service:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-saml2:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_saml2:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:security:security:6.5.9:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:6.5.9:*:*:*:*:*:*:*"],"name":"spring-security-saml2-service-provider","purl":"pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.9","type":"java-archive","version":"6.5.9","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.9.jar","manifestName":"","pomArtifactID":"spring-security-saml2-service-provider","archiveDigests":[{"value":"e3c202a32f607cae7909508c9c4b377dd382132c","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-security-saml2-service-provider-6.5.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.5.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ww38-37g9-m3q3","versionConstraint":">=6.5.0,<=6.5.10 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-saml2-service-provider","version":"6.5.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ww38-37g9-m3q3","fix":{"state":"fixed","versions":["6.5.11"],"available":[{"date":"2026-08-12","kind":"first-observed","version":"6.5.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41694","cwe":"CWE-347","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41694","date":"2026-10-27","epss":0.00148,"percentile":0.03934}],"risk":0.04957999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41694","https://spring.io/security/cve-2026-41694","https://github.com/spring-projects/spring-security/releases/tag/6.5.11","https://github.com/spring-projects/spring-security/releases/tag/7.0.6"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ww38-37g9-m3q3","description":"Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads"},"relatedVulnerabilities":[{"id":"CVE-2026-41694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41694","cwe":"CWE-347","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41694","date":"2026-10-27","epss":0.00148,"percentile":0.03934}],"urls":["https://spring.io/security/cve-2026-41694"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41694","description":"Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.\n\nAffected versions:\nSpring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5."}]},{"artifact":{"id":"2b3afcc4f75e7920","cpes":["cpe:2.3:a:apache:shiro-core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro_core:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:shiro:1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:1.13.0:*:*:*:*:*:*:*"],"name":"shiro-core","purl":"pkg:maven/org.apache.shiro/shiro-core@1.13.0","type":"java-archive","version":"1.13.0","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.shiro","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","manifestName":"","pomArtifactID":"shiro-core","archiveDigests":[{"value":"7e542e3d614b197bf10005e98e19f9f19cb943e7","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/shiro-core-1.13.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c4qc-4q9p-m9q9","versionConstraint":"<2.1.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.shiro:shiro-core","version":"1.13.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c4qc-4q9p-m9q9","fix":{"state":"fixed","versions":["2.1.0"],"available":[{"date":"2026-02-10","kind":"first-observed","version":"2.1.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23901","cwe":"CWE-208","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23901","date":"2026-10-27","epss":0.00245,"percentile":0.15646}],"risk":0.049,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-23901","https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh","http://www.openwall.com/lists/oss-security/2026/02/08/2"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c4qc-4q9p-m9q9","description":"Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-23901","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Green","metrics":{"baseScore":1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-23901","cwe":"CWE-208","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-23901","date":"2026-10-27","epss":0.00245,"percentile":0.15646}],"urls":["https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh","http://www.openwall.com/lists/oss-security/2026/02/08/2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23901","description":"Observable Timing Discrepancy vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7 or later, which fixes the issue.\n\nPrior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,\nthat a brute-force attack may be able to tell, by timing the requests only, determine if\nthe request failed because of a non-existent user vs. wrong password.\n\nThe most likely attack vector is a local attack only.\nShiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.\n\nTypically, brute force attack can be mitigated at the infrastructure level."}]},{"artifact":{"id":"7ff3234314ee8e12","cpes":["cpe:2.3:a:spring-boot-autoconfigure:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot-autoconfigure:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot_autoconfigure:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot_autoconfigure:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring-boot-autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:boot:spring_boot_autoconfigure:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot-autoconfigure:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot_autoconfigure:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.boot:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:springframework:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring-boot:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring_boot:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:spring:boot:3.5.12:*:*:*:*:*:*:*","cpe:2.3:a:boot:boot:3.5.12:*:*:*:*:*:*:*"],"name":"spring-boot-autoconfigure","purl":"pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.12","type":"java-archive","version":"3.5.12","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework.boot","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-boot-autoconfigure-3.5.12.jar","manifestName":"","pomArtifactID":"spring-boot-autoconfigure","archiveDigests":[{"value":"5c150628493f049b93c0e499063167a08ba5e3b6","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/spring-boot-autoconfigure-3.5.12.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ggg2-9786-hwc8","versionConstraint":">=3.5.0,<=3.5.14 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.boot:spring-boot-autoconfigure","version":"3.5.12"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ggg2-9786-hwc8","fix":{"state":"fixed","versions":["3.5.15"],"available":[{"date":"2026-08-22","kind":"first-observed","version":"3.5.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41001","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41001","date":"2026-10-27","epss":0.00094,"percentile":0.00582}],"risk":0.04841,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-41001","https://spring.io/security/cve-2026-41001","https://github.com/spring-projects/spring-boot/commit/4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ggg2-9786-hwc8","description":"Spring Boot: Predictable Temp Directory in Artemis Auto-configuration"},"relatedVulnerabilities":[{"id":"CVE-2026-41001","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"impactScore":3.4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41001","cwe":"CWE-377","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2026-41001","date":"2026-10-27","epss":0.00094,"percentile":0.00582}],"urls":["https://spring.io/security/cve-2026-41001"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41001","description":"Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33."}]},{"artifact":{"id":"2da8cae68887fec2","cpes":["cpe:2.3:a:logback-core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos-ch:logback_core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback-core:1.5.19:*:*:*:*:*:*:*","cpe:2.3:a:qos_ch:logback_core:1.5.19:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.5.19","type":"java-archive","version":"1.5.19","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"8847d9fcb02c62c338ba26e2b28059dd585ea1a9","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/logback-core-1.5.19.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5.25"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qqpg-mvqg-649v","versionConstraint":"<1.5.25 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.5.19"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qqpg-mvqg-649v","fix":{"state":"fixed","versions":["1.5.25"],"available":[{"date":"2026-01-23","kind":"first-observed","version":"1.5.25"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1225","cwe":"CWE-20","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-1225","date":"2026-10-27","epss":0.00162,"percentile":0.05388}],"risk":0.03888,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-1225","https://logback.qos.ch/news.html#1.5.25","https://github.com/qos-ch/logback/issues/997","https://github.com/qos-ch/logback/commit/1f97ae1844b1be8486e4e9cade98d7123d3eded5"],"severity":"Low","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qqpg-mvqg-649v","description":"Logback allows an attacker to instantiate classes already present on the class path"},"relatedVulnerabilities":[{"id":"CVE-2026-1225","cvss":[{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:M/U:Green","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1225","cwe":"CWE-20","type":"Secondary","source":"vulnerability@ncsc.ch"}],"epss":[{"cve":"CVE-2026-1225","date":"2026-10-27","epss":0.00162,"percentile":0.05388}],"urls":["https://logback.qos.ch/news.html#1.5.25"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1225","description":"ACE vulnerability in configuration file processing  by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.\n\n\n\n\nThe instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must  have write access to a \nconfiguration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado."}]},{"artifact":{"id":"db0be20435ff9026","cpes":["cpe:2.3:a:gnu:tar:1.35-r5:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r5:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r5?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.35-r5","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:46c96056dd30c54dca9f63924777553c2122b77934c9c4b3579f0291efe9f6b5","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18477","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r5"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-10-27","epss":0.0008,"percentile":0.00152}],"risk":0.0376,"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"53a2bd73288ce2ae","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.21.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.21.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1","type":"java-archive","version":"2.21.1","language":"java","licenses":["https://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"5615fb77652bfd386d87b95a1d663e1c0e38b372","algorithm":"sha1"}]},"locations":[{"path":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar","layerID":"sha256:2e0203578be4500f6788f3a2758e247d06ebff8f50fab3f194ea93e59c247322","accessPath":"/opt/sonatype/nexus/bin/sonatype-nexus-repository-3.91.2-01.jar:BOOT-INF/lib/jackson-databind-2.21.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.21.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhm7-754m-9p8w","versionConstraint":">=2.21.0,<=2.21.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.21.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mhm7-754m-9p8w","fix":{"state":"fixed","versions":["2.21.5"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"2.21.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhm7-754m-9p8w","description":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-28T15:08:41.863Z","grype_db_version":"2026-10-28T06:23:30.000Z"}