| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 |
com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-89407 · GHSA-P6PP-M3F8-5C89 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Micrometer HTTP server instrumentations DoSCVE-2026-40984 · GHSA-G3PR-3P32-FP23 |
io.micrometer:micrometer-coreio.micrometer:micrometer-jetty11 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteCVE-2026-59903 · GHSA-8C42-7QJ2-3J46 |
io.netty:netty-codec-httpExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59900 · GHSA-C69G-56F8-XWQJ |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-59898 · GHSA-4MP9-239F-G9HG |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortCVE-2026-45673 · GHSA-XMV7-R254-6Q78 |
io.netty:netty-resolver-dnsCryostat 4/netty-resolver-dns |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesCVE-2026-54515 · GHSA-5JMJ-H7XM-6Q6V |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| jackson-databind has @JsonView bypass for setterless creator propertiesCVE-2026-54517 · GHSA-5HH8-Q8HV-FR38 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty Lz4FrameDecoder is vulnerable to resource exhaustion CVE-2026-42583 · GHSA-MJ4R-2HFC-F8P6 |
io.netty:netty-codec-compressionio.netty:netty-codec |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580 · GHSA-M4CV-J2PX-7723 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-EncodingCVE-2026-42585 · GHSA-38F8-5428-X5CV |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59921 · GHSA-GCJF-9MGH-3P7G |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
