Vulnerabilities

TI-2024-01613 CVE-2024-1735 · GHSA-4m6j-23p2-8c54

Improper authentication in LINE Corporation Armeria

MEDIUM 49

A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00834 Published 2024-02-26 Fixed in 1.27.2 CWE-287

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-19873 CVE-2023-38493 · GHSA-wvp2-9ppw-337j

Paths contain matrix variables bypass decorators

MEDIUM 40

Armeria is a microservice framework Spring supports Matrix variables.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0072 Published 2023-07-25 Fixed in 1.24.3 CWE-863

TI-2021-19602 CVE-2021-43795 · GHSA-8fp4-rp6c-5gcv

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria

LOW 36

Armeria is an open source microservice framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01692 Published 2021-12-02 Fixed in 1.13.4 CWE-22

TI-2019-12552 CVE-2019-16771 · GHSA-24r8-fm9r-cpj2

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria

LOW 31

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to popula…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00982 Published 2019-12-06 Fixed in 0.97.0 CWE-113