Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

Quarkus authorization bypass via semicolon path normalization inconsistency

Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

Netty's wrapping plain trust manager silently disables hostname verification

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Netty: SCTP reassembly nests buffers without bound

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Vite has a `server.fs.deny` bypass with queries

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Undertow: undertow madeyoureset http/2 ddos vulnerability

Undertow: url-encoded request path information can be broken on ajp-listener

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Eap: wildfly-elytron has a ssrf security issue

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission