Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

AngularJS XSS via SCE resource URL sanitization bypass

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

path-to-regexp vulnerable to Denial of Service via sequential optional groups

flatted: Unbounded recursion DoS in parse() revive phase

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Keycloak: amount of attributes per object is not limited and it may lead to dos

Undertow: improper state management in proxy protocol parsing causes information leakage

Undertow: url-encoded request path information can be broken on ajp-listener

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

Undertow: cookie smuggling/spoofing