TI-2025-30956 CVE-2025-48734 · GHSA-wxr5-93ph-8wr9
Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Priority HIGH 73
Improper Access Control vulnerability in Apache Commons.
RHSA-2025:12511
Streams for Apache Kafka 3.0.0 release and security update
Released 2025-08-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Streams for Apache Kafka 3.0.0
Fixes 13 records
TI-2025-18650 CVE-2025-24970 · GHSA-4g8c-wm8x-jfhw
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
Priority HIGH 72
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final.
TI-2023-01295 CVE-2023-1370 · GHSA-493p-pfq6-5258
Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON
Priority HIGH 72
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.
TI-2025-33749 CVE-2025-53864 · GHSA-xwmg-2g98-w7v9
Uncontrolled recursion in Connect2id Nimbus JOSE+JWT
Priority HIGH 65
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recurs…
TI-2025-18862 CVE-2025-25193 · GHSA-389x-839f-4rhx
Denial of Service attack on windows app using Netty
Priority MEDIUM 58
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final.
TI-2024-31824 CVE-2024-47535 · GHSA-xq3w-v528-46rv
Denial of Service attack on windows app using Netty
Priority MEDIUM 58
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.
TI-2024-06269 CVE-2024-6763 · GHSA-qh8g-58pp-2wxh
Jetty URI parsing of invalid authority
Priority MEDIUM 57
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine .
TI-2025-01403 CVE-2025-1634 · GHSA-4fwr-mh5q-hchh
Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
Priority MEDIUM 41
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made.
TI-2024-12058 CVE-2024-13009 · GHSA-q4rv-gq96-w7c5
Eclipse Jetty GZIP buffer release
Priority LOW 38
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body.
TI-2025-31064 CVE-2025-48924 · GHSA-j288-q9x7-2f5v
Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
Priority LOW 35
Uncontrolled Recursion vulnerability in Apache Commons Lang.
TI-2024-20521 CVE-2024-31141 · GHSA-2x2g-32r7-p4x8
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider
Priority LOW 32
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.
TI-2025-31587 CVE-2025-49574 · GHSA-9623-mj7j-p9v4
Quarkus potential data leak when duplicating a duplicated context
Priority LOW 30
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications.
TI-2024-37123 CVE-2024-56128 · GHSA-p7c9-8xx8-h74f
Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
Priority LOW 26
Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation.