Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Containers/image: digest type does not guarantee valid type

Quarkus authorization bypass via semicolon path normalization inconsistency

kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

fast-uri vulnerable to host confusion via failed IDN canonicalization

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Netty's wrapping plain trust manager silently disables hostname verification

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

Incorrect enforcement of email constraints in crypto/x509

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Golang-fips: golang fips zeroed buffer

Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Undertow: learningpushhandler can lead to remote memory dos attacks

Cert-manager: potential dos when parsing specially crafted pem inputs

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results