PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

path-to-regexp vulnerable to Denial of Service via sequential optional groups

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Keycloak: amount of attributes per object is not limited and it may lead to dos

Undertow: improper state management in proxy protocol parsing causes information leakage

Undertow: url-encoded request path information can be broken on ajp-listener

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Undertow: cookie smuggling/spoofing

Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled

Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

Jastow: jastow cross-site scripting attack due to unsanitized uri

LDAP Injection Vulnerability in LDAPStoreHelper.java

Org.keycloak:keycloak-services: keycloak denial of service

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

React Router vulnerable to XSS via Open Redirects

Rhsso: open redirect

Keycloak: xss via assertion consumer service url in saml post-binding flow

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Undertow: learningpushhandler can lead to remote memory dos attacks

Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

Wildfly-core: path traversal on wildfly domain controller

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2