Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

Quarkus authorization bypass via semicolon path normalization inconsistency

Micrometer HTTP server instrumentations DoS vulnerability

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Values produced by ${random.value} are not suitable for use as secrets

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Quarkus-core: leak of local configuration properties into quarkus applications

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Undertow: learningpushhandler can lead to remote memory dos attacks