Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Undertow: undertow: request smuggling via inconsistent header parsing

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

Quarkus authorization bypass via semicolon path normalization inconsistency

Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

Netty's wrapping plain trust manager silently disables hostname verification

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Netty: SCTP reassembly nests buffers without bound

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Vite has a `server.fs.deny` bypass with queries

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Undertow: undertow madeyoureset http/2 ddos vulnerability

Undertow: url-encoded request path information can be broken on ajp-listener

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Eap: wildfly-elytron has a ssrf security issue

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Jastow: jastow cross-site scripting attack due to unsanitized uri

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Narayana: deadlock via multiple join requests sent to lra coordinator