Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

fast-uri vulnerable to host confusion via failed IDN canonicalization

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Netty's wrapping plain trust manager silently disables hostname verification

Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty's Default QUIC token handler accepts any client-supplied token

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

ws: Uninitialized memory disclosure

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Incorrect enforcement of email constraints in crypto/x509

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Undertow: improper state management in proxy protocol parsing causes information leakage

Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket

Quarkus-core: leak of local configuration properties into quarkus applications

Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

ip-address: XSS in Address6 HTML-emitting methods

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain