Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

path-to-regexp vulnerable to Denial of Service via sequential optional groups

HAPI FHIR HTTP authentication leak in redirects

flatted: Unbounded recursion DoS in parse() revive phase

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Undertow: undertow madeyoureset http/2 ddos vulnerability

Smallrye-fault-tolerance: smallrye fault tolerance

Undertow: improper state management in proxy protocol parsing causes information leakage

Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket

Undertow: url-encoded request path information can be broken on ajp-listener

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Undertow: cookie smuggling/spoofing

Apache Thrift: TSSLTransportFactory.java hostname verification

Wildfly: wildfly vulnerable to cross-site scripting (xss)

Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

LDAP Injection Vulnerability in LDAPStoreHelper.java

Org.wildfly.core:wildfly-server: wildfly improper rbac permission

Jberet: jberet-core logging database credentials

Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.

Fuse: privilege escalation via excessive /etc/passwd permissions

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

Angular: SSRF via Hostname Hijacking in @angular/platform-server

Angular i18n vulnerable to Cross-Site Scripting (XSS)

node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

React Router vulnerable to XSS via Open Redirects

Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss

Keycloak: xss via assertion consumer service url in saml post-binding flow

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Undertow: learningpushhandler can lead to remote memory dos attacks

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.