Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Undertow: undertow: request smuggling via inconsistent header parsing

Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Jastow: jastow cross-site scripting attack due to unsanitized uri

LDAP Injection Vulnerability in LDAPStoreHelper.java

Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

Wildfly-core: path traversal on wildfly domain controller

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths