| Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersCVE-2026-34479 · GHSA-H383-GMXW-35V2 |
org.apache.logging.log4j:log4j-coreRed Hat Data Grid 8/log4j-1.2-api |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.CVE-2026-22741 · GHSA-WG35-8JPF-2XV3 |
org.springframework:spring-webfluxorg.springframework:spring-webmvc |
MavenRed Hat |
Low
|
Fix reported |
|
| Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayoutCVE-2026-34481 · GHSA-W35J-PV5H-Q9Q9 |
org.apache.logging.log4j:log4j-layout-template-jsonRed Hat Enterprise Linux 9/log4j |
MavenRed Hat |
Medium
|
Fix reported |
|
| Spring MVC and WebFlux has Server Sent Event stream corruptionCVE-2026-22735 · GHSA-6HCQ-HMM3-JJ3C |
org.springframework:spring-webfluxorg.springframework:spring-webmvc |
MavenRed Hat |
Low
|
Fix reported |
|
| Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configurationCVE-2026-34477 · GHSA-6HG6-V5C8-FPHQ |
org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-2-2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibilityCVE-2026-34478 · GHSA-445C-VH5M-36RJ |
org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-3 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersCVE-2026-34480 · GHSA-3PXV-7CMR-FJR4 |
org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-3 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Spring Framework Improper Path Limitation with Script View TemplatesCVE-2026-22737 · GHSA-4773-3JFM-QMX3 |
org.springframework:spring-webfluxorg.springframework:spring-webmvc |
MavenRed Hat |
Medium
|
Fix reported |
|
| Logback allows an attacker to instantiate classes already present on the class pathCVE-2026-1225 · GHSA-QQPG-MVQG-649V |
ch.qos.logback:logback-coreLogging Subsystem for Red Hat OpenShift/logback-core |
MavenRed Hat |
Low
|
Fix reported |
|
| Apache Log4j does not verify the TLS hostname in its Socket AppenderCVE-2025-68161 · GHSA-VC5P-V9HR-52MJ |
org.apache.logging.log4j:log4j-coreLogging Subsystem for Red Hat OpenShift/log4j-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processingCVE-2025-11226 · GHSA-25QH-J22F-PWP8 |
ch.qos.logback:logback-coreLogging Subsystem for Red Hat OpenShift/logback-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messagesCVE-2025-41254 · GHSA-7FCH-4F2F-JCGM |
org.springframework:spring-websocketLogging Subsystem for Red Hat OpenShift/spring-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| Spring Framework MVC Applications Path Traversal VulnerabilityCVE-2025-41242 · GHSA-R936-GWX5-V52F |
org.springframework:spring-webmvcRed Hat AMQ Broker 7/spring-webmvc |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsCVE-2025-48924 · GHSA-J288-Q9X7-2F5V |
commons-lang:commons-langorg.apache.commons:commons-lang3 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Spring Framework vulnerable to a reflected file download (RFD)CVE-2025-41234 · GHSA-6R3C-XF4W-JXJM |
org.springframework:spring-webOpenShift Developer Tools and Services/jenkins |
MavenRed Hat |
Medium
|
Fix reported |
|
| Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationCVE-2025-49128 · GHSA-WF8F-6423-GFXG |
com.fasterxml.jackson.core:jackson-coreCryostat 4/jackson-core |
MavenRed Hat |
Medium
|
Fix reported |
|
| snappy-java's unchecked chunk length leads to DoSCVE-2023-34455 · GHSA-QCWQ-55HX-V3VH |
org.xerial.snappy:snappy-javaOpenShift Serverless/snappy-java |
MavenRed Hat |
High
|
Fix reported |
|
| Snakeyaml vulnerable to Stack overflow leading to denial of serviceCVE-2022-41854 · GHSA-W37G-RHQ8-7M4J |
org.yaml:snakeyamlA-MQ Clients 2/dev-java-snakeyaml |
MavenRed Hat |
Medium
|
Fix reported |
|
| netty-handler SniHandler 16MB allocationCVE-2023-34462 · GHSA-6MJQ-H674-J845 |
io.netty:netty-handlerA-MQ Clients 2/netty |
MavenRed Hat |
Medium
|
Fix reported |
|
