Red Hat Hardened Images/maven3.9

Red Hat · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH	com.fasterxml.jackson.core:jackson-databind tools.jackson.core:jackson-databind	MavenRed Hat	Medium	Fix reported	2026-10-19
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106451 · GHSA-MCR4-QMVW-PX4G	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	High	Fix reported	2026-10-08
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-106450 · GHSA-GM45-99XC-R7WV	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-10-08
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorCVE-2026-106453 · GHSA-6CX8-RJF8-PR8G	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-10-07
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106452 · GHSA-4V53-57PG-C464	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-10-07
LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array rangesCVE-2026-59949 · GHSA-XX22-P4CH-683R	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-09-10