Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

protobufjs has an arbitrary code execution issue

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

undici WebSocket client vulnerable to denial of service via fragment count bypass

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Netty's wrapping plain trust manager silently disables hostname verification

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

Go JOSE affect by a panic in JWE decryption

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh