| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerabilityCVE-2026-49432 · GHSA-XJWQ-9JW5-JF7W |
org.apache.activemq:activemq-allorg.apache.activemq:activemq-stomp |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerabilityCVE-2026-53917 · GHSA-F77W-PX59-CQF5 |
org.apache.activemq:activemq-allorg.apache.activemq:activemq-broker |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerabilityCVE-2026-49434 · GHSA-H5GM-RVW6-2XPX |
org.apache.activemq:activemq-allorg.apache.activemq:activemq-broker |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-59898 · GHSA-4MP9-239F-G9HG |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580 · GHSA-M4CV-J2PX-7723 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59921 · GHSA-GCJF-9MGH-3P7G |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has a @JsonView bypass for unwrapped creator parametersCVE-2026-54518 · GHSA-RCQC-6CW3-H962 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fieldsCVE-2026-54516 · GHSA-9FXM-VC8V-HJ55 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request InjectionCVE-2026-41417 · GHSA-V8H7-RR48-VMMV |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| mchange-commons-java: Remote Code Execution via JNDI Reference ResolutionCVE-2026-27727 · GHSA-M2CM-222F-QW44 |
com.mchange:mchange-commons-javaRed Hat Fuse 7/mchange-commons-java |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS ConditionCVE-2026-18401 · GHSA-72HV-8253-57QQ |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Logback allows an attacker to instantiate classes already present on the class pathCVE-2026-1225 · GHSA-QQPG-MVQG-649V |
ch.qos.logback:logback-coreLogging Subsystem for Red Hat OpenShift/logback-core |
MavenRed Hat |
کم
|
اصلاح گزارش شده |
|
| Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoderCVE-2025-67735 · GHSA-84H7-RJJ3-6JX4 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processingCVE-2025-11226 · GHSA-25QH-J22F-PWP8 |
ch.qos.logback:logback-coreLogging Subsystem for Red Hat OpenShift/logback-core |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty vulnerable to request smuggling due to incorrect parsing of chunk extensionsCVE-2025-58056 · GHSA-FGHV-69VJ-QJ49 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
کم
|
اصلاح گزارش شده |
|
| Bouncy Castle for Java Uncontrolled Resource Consumption VulnerabilityCVE-2025-9092 · GHSA-V6CF-MV9H-C8MC |
org.bouncycastle:bc-fipsCryostat 4/bcpkix-jdk18on |
MavenRed Hat |
کم
|
اصلاح گزارش شده |
|
