| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513 · GHSA-RMJ7-2VXQ-3G9F |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressCVE-2026-59919 · GHSA-WH89-7897-X99H |
io.netty:netty-codec-haproxyCryostat 4/netty-codec-haproxy |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)CVE-2026-56819 · GHSA-93WV-JW9V-4972 |
io.netty:netty-codec-http2OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59900 · GHSA-C69G-56F8-XWQJ |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory ExhaustionCVE-2026-55851 · GHSA-Q6CQ-MHR2-JMR5 |
io.netty:netty-codec-haproxyOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: STOMP CONNECT Frame Header Injection in NettyCVE-2026-59920 · GHSA-3G8R-4PFX-JMFH |
io.netty:netty-codec-stompRed Hat Data Grid 8/netty-codec-stomp |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-59898 · GHSA-4MP9-239F-G9HG |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: Security Control Bypass via CORS Short-Circuit FailureCVE-2026-56746 · GHSA-6CQP-G7GG-8HR5 |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty SPDY SETTINGS frame count materializes unbounded settings mapCVE-2026-55831 · GHSA-6JQX-86GH-F27W |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate stateCVE-2026-56818 · GHSA-P9JM-Q85P-7MCP |
io.netty:netty-codec-redisRed Hat Data Grid 8/netty-codec-redis |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jsoup: Cleaner may expose markup with custom raw-text elementsCVE-2026-71497 · GHSA-PMHH-3W7G-XQP8 |
org.jsoup:jsoupCryostat 4/jsoup |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serializationCVE-2026-49844 · GHSA-QV9R-C865-CP47 |
org.apache.logging.log4j:log4j-apiCryostat 4/log4j-api |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of serviceCVE-2026-54399 · GHSA-HF6X-8P5F-CGMF |
org.apache.httpcomponents.core5:httpcore5Cryostat 4/httpcore |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59921 · GHSA-GCJF-9MGH-3P7G |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceCVE-2026-59899 · GHSA-Q4F6-JM68-57WW |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationCVE-2026-55833 · GHSA-MVH2-CRG5-V77C |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
