Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

flatted: Prototype Pollution via parse()

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Undertow: undertow: request smuggling via inconsistent header parsing

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

AngularJS XSS via SCE resource URL sanitization bypass

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.