Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

Netty's wrapping plain trust manager silently disables hostname verification

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Netty: SCTP reassembly nests buffers without bound

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Netty: Resource exhaustion in MqttDecoder

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

xmldom: XML node injection through unvalidated processing instruction serialization

xmldom: XML injection through unvalidated DocumentType serialization

xmldom: Denial of service via uncontrolled recursion in XML serialization

xmldom: XML node injection through unvalidated comment serialization

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader

Values produced by ${random.value} are not suitable for use as secrets

Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

Non-constant time comparisons risk private key leakage in FrodoKEM.

GOSTCTR implementation unable to process more than 255 blocks correctly

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing