Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Undertow: undertow: request smuggling via inconsistent header parsing

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

Quarkus authorization bypass via semicolon path normalization inconsistency

simple-git has Command Execution via Option-Parsing Bypass

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Micrometer HTTP server instrumentations DoS vulnerability

Netty: Resource exhaustion in MqttDecoder

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Undertow: undertow madeyoureset http/2 ddos vulnerability

Undertow: improper state management in proxy protocol parsing causes information leakage

Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket

Undertow: url-encoded request path information can be broken on ajp-listener

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Undertow: cookie smuggling/spoofing

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

LDAP Injection Vulnerability in LDAPStoreHelper.java

Rhpam: privilege escalation via excessive /etc/passwd permissions

Keycloak: xss via assertion consumer service url in saml post-binding flow

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Undertow: learningpushhandler can lead to remote memory dos attacks

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.