Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Openjdk-orb: unauthed class loading via iiop in eap

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

Undertow-core: oom via missing limits in chunked trailer in eap's undertow

Netty's wrapping plain trust manager silently disables hostname verification

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

Non-constant time comparisons risk private key leakage in FrodoKEM.

GOSTCTR implementation unable to process more than 255 blocks correctly

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed…

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Undertow: undertow madeyoureset http/2 ddos vulnerability

Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery