Find, fix and prevent vulnerabilities in your code.

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect control flow in the RewriteValve process. An attacker can bypass intended rewrite rules by crafting requests that exploit the improper evaluation of OR chains in conditions.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

• Apache Mailing List
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• GitHub Commit
• GitHub Commit

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Certificate Validation in getSSLHostConfig(), which does not sufficiently account for all protocol host name inputs. An attacker can access sensitive information in some cases.

Note: This is a partial bypass for the vulnerability described in CVE-2025-66614.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.116, 10.1.53, 11.0.20 or higher.

References

• Apache Mailing List
• GitHub Commit

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the processing of HTTP/2 request headers. An attacker can cause unexpected behavior or potentially compromise the application by sending specially crafted HTTP/2 request headers.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.118, 10.1.55, 11.0.22 or higher.

References

• Apache Mailing List
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via static resource resolution. An attacker can cause denial of service by sending crafted requests that are slow to resolve when accessing file-system-backed static resources, causing HTTP connections to remain occupied and exhausting server resources.

Note: This is only exploitable if all the following are true:

1. The application uses Spring MVC or Spring WebFlux.

2. Static resources are served from the file system.

3. The application is running on Windows.

Remediation

Upgrade org.springframework:spring-core to version 6.2.18, 7.0.7 or higher.

References

• GitHub Commit
• spring Security Advisory

Overview

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via Spring Expression Language (SpEL) method invocation handling. An attacker can invoke arbitrary zero-argument methods by supplying crafted SpEL expressions, even in contexts intended to restrict method execution or provide read-only access. This may allow execution of unintended application logic and access to functionality that should not be exposed through expression evaluation.

Note: This is only exploitable if the application accepts and evaluates untrusted or user-controlled SpEL expressions.

Remediation

Upgrade org.springframework:spring-expression to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to HTTP Request Smuggling via multipart request parsing discrepancies between Spring MVC/WebFlux and intermediary security devices. An attacker can bypass Web Application Firewall (WAF) or proxy security controls by sending crafted multipart requests that are interpreted differently by the intermediary and the Spring application, allowing malicious content to evade inspection and reach the backend application.

Remediation

Upgrade org.springframework:spring-web to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to HTTP Request Smuggling. via multipart request parsing discrepancies between Spring MVC/WebFlux and intermediary security devices. An attacker can bypass Web Application Firewall (WAF) or proxy security controls by sending crafted multipart requests that are interpreted differently by the intermediary and the Spring application, allowing malicious content to evade inspection and reach the backend application.

Remediation

Upgrade org.springframework:spring-webmvc to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit

• GitHub Release

• GitHub Release

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._renameProperties() and BeanDeserializerFactory.addBeanProps() methods, which rename rather than drop a property whose getter carries @JsonProperty and whose setter carries @JsonIgnore, leaving the private backing field writable. An attacker can write a field that was meant to be unsettable, enabling property tampering and mass assignment, by supplying the renamed JSON key during deserialization, because the factory observes hasField()==true and builds a writable FieldProperty for the backing field. Exploitation requires MapperFeature.INFER_PROPERTY_MUTATORS to be enabled, which is the default, and a target type that pairs a renamed getter with an ignored setter, and the impact is limited to writing existing fields with no path to remote code execution.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub Issue

Overview

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.

Workaround

This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade ch.qos.logback:logback-classic to version 1.5.33 or higher.

References

• GitHub Commit
• Release Notes

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.

Workaround

This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.5.33 or higher.

References

• GitHub Commit
• Release Notes

Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the MapMessage.asJson() method, which emits the bare NaN, Infinity, or -Infinity tokens instead of an RFC 8259-compliant representation. An attacker can emit malformed JSON that corrupts the enclosing log record or disrupts downstream log ingestion and parsing by supplying non-finite floating-point values that the application records in a logged MapMessage. Exploitation requires the application to use the message resolver of JsonTemplateLayout, or another layout relying on MapMessage.asJson(), and to log a MapMessage holding attacker-controlled floating-point values.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-34481.

Remediation

A fix was pushed into the master branch but not yet published.

References

• event-template-resolver-message Documentation
• GitHub Commit
• GitHub PR
• Vulnerability Advisory

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in JsonAccessLogValve(), which relies on an unescaped append() in generating JSON logs. If non-default values are used for the Connector attributes relaxedPathChars or relaxedQueryChars, an attacker can inject malicious JSON into logs.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.117, 10.1.54, 11.0.21 or higher.

References

• Apache Mailing List
• GitHub Commit
• OSS Security Advisory

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.118, 10.1.55, 11.0.22 or higher.

References

• Apache Mailing List
• GitHub Commit
• GitHub Commit

Overview

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via pattern processing in AntPathMatcher. An attacker can cause denial of service by supplying a crafted regular expression pattern to methods such as match(), matchStart(), or extractUriTemplateVariables(), triggering excessive backtracking and CPU consumption during pattern evaluation.

Note: This is only exploitable if attacker-controlled input is used directly or indirectly as the pattern argument to one of the affected AntPathMatcher methods.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

• A The string must start with the letter 'A'
• (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
• D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

1. CCC
2. CC+C
3. C+CC
4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade org.springframework:spring-core to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via incorrect host parsing in UriComponentsBuilder. An attacker can perform server-side request forgery by supplying a crafted URL that is interpreted differently than intended during validation, allowing requests to be sent to unintended hosts despite application-level hostname validation checks.

Remediation

Upgrade org.springframework:spring-web to version 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Session Fixation via session fixation handling. An attacker controlling a compromised subdomain can obtain a known session identifier and subsequently cause it to be associated with an authenticated user session, allowing unauthorized use of the victim's authenticated session.

Note: This is only exploitable if an attacker can control or execute script within a subdomain of the target application (for example through a cross-site scripting vulnerability).

Remediation

Upgrade org.springframework:spring-web to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Symlink Attack due to insecure handling of Process ID (PID) files. When an application uses the ApplicationPidFileWriter, it writes its PID to a predictable file system path. A local attacker with write access to the PID file's directory can create a symbolic link (symlink) at that path. When the Spring Boot application starts, it follows this symlink and overwrites the target file with its PID. This allows the attacker to corrupt or "clobber" sensitive system files, potentially leading to a denial of service or system instability.

Remediation

Upgrade org.springframework.boot:spring-boot to version 3.5.14, 4.0.6 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective web.xml when special roles and empty authorization constraints are present. An attacker can bypass intended access restrictions by exploiting the absence of these constraints in the logged configuration.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

• Apache Mailing List
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Authorization in the processing of security constraints when multiple method constraints define an HTTP method for the same extension. An attacker can gain unauthorized access to protected resources by crafting requests that exploit the improper application of these constraints.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.118, 10.1.55, 11.0.22 or higher.

References

• Apache Mailing List
• GitHub Commit

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Authorization due to the improper enforcement of security constraints in the default servlet when certain HTTP methods or method omissions are configured. An attacker can gain unauthorized access to protected resources by sending requests using HTTP methods that are not properly restricted.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

• Apache Mailing List
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the LockOutRealm function. An attacker can bypass account lockout protections by submitting usernames with different letter casing.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.118, 10.1.55, 11.0.22 or higher.

References

• Apache Mailing List
• GitHub Commit

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper escaping in JavaScriptUtils.javaScriptEscape(). An attacker can inject arbitrary JavaScript code into a web page when user-controlled input is escaped using javaScriptEscape() and subsequently embedded into a JavaScript context. Incorrect escaping may allow malicious input to break out of the intended context and execute in the victim's browser.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-web to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the BeanDeserializer._deserializeUsingPropertyBased method, whose property-buffering branch omits the prop.visibleInView(activeView) check that the creator-property branch performs. An attacker can populate view-restricted setterless collection or map properties, such as admin-only fields, from untrusted JSON by supplying values for them during deserialization, bypassing @JsonView protection. This affects only setterless collection or map properties annotated with a restricted @JsonView and reached through the property-based creator path.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR