Tagged “maven”
CVEs tagged maven, newest first.
321 CVEsRSS
CVE-2026-41726Medium· 6.5In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
CVE-2026-47838Medium· 6.8Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
CVE-2025-53114High· 7.5Acknowledgement extension out of memory
Acknowledgement extension out of memory
CVE-2026-40984High· 7.5In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.1…
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.1…
CVE-2026-40983High· 7.5In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
CVE-2026-41855High· 8.1In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…
CVE-2026-44892High· 7.5Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
CVE-2026-44894High· 7.5Netty's Default QUIC token handler accepts any client-supplied token
Netty's Default QUIC token handler accepts any client-supplied token
CVE-2026-44503HighKiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CVE-2026-42027Critical· 9.8⚖ disputedArbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loa…
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) method loa…
CVE-2025-14813High· 7.5: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects B…
CVE-2025-37731Medium· 6.8Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates
Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates
CVE-2025-67505High· 8.4Okta Java Management SDK facilitates interactions with the Okta management API
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response h…
CVE-2024-52980Medium· 6.5Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function
Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function
CVE-2024-49771Medium· 5.3MPXJ has a Potential Path Traversal Vulnerability
MPXJ has a Potential Path Traversal Vulnerability
CVE-2023-41329Low· 3.9Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
CVE-2023-32732Medium· 5.3gRPC connection termination issue
gRPC connection termination issue
CVE-2023-1428High· 7.5gRPC Reachable Assertion issue
gRPC Reachable Assertion issue
CVE-2023-32731High· 7.4Connection confusion in gRPC
Connection confusion in gRPC
CVE-2023-34620High· 7.5hjson stack exhaustion vulnerability
hjson stack exhaustion vulnerability
CVE-2020-8897High· 8.1Security issues in AWS KMS and AWS Encryption SDKs: in-band protocol negotiation and robustness
Security issues in AWS KMS and AWS Encryption SDKs: in-band protocol negotiation and robustness