Find, fix and prevent vulnerabilities in your code.

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect control flow in the RewriteValve process. An attacker can bypass intended rewrite rules by crafting requests that exploit the improper evaluation of OR chains in conditions.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

• Apache Mailing List
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• GitHub Commit
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._renameProperties() and BeanDeserializerFactory.addBeanProps() methods, which rename rather than drop a property whose getter carries @JsonProperty and whose setter carries @JsonIgnore, leaving the private backing field writable. An attacker can write a field that was meant to be unsettable, enabling property tampering and mass assignment, by supplying the renamed JSON key during deserialization, because the factory observes hasField()==true and builds a writable FieldProperty for the backing field. Exploitation requires MapperFeature.INFER_PROPERTY_MUTATORS to be enabled, which is the default, and a target type that pairs a renamed getter with an ignored setter, and the impact is limited to writing existing fields with no path to remote code execution.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub Issue

Overview

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the STD_INET_ADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind SSRF behavior by supplying a hostname string in JSON that is deserialized into java.net.InetAddress. When application code binds untrusted input into an InetAddress field or type, the deserializer calls InetAddress.getByName(value) on the attacker-controlled string and resolves it before any application validation runs. This lets an attacker force DNS-based callbacks or probe internal hostnames, causing unwanted network egress and leaking resolver-visible information.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.5, 3.2.1 or higher.

References

• GitHub Commit jackson-databind-2.21.1
• GitHub Commit jackson-databind-3.2.1
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue() to resolve an attacker-controlled java.nio.file.Path URI by supplying a non-file scheme such as jar:, http:, s3:, or a custom provider scheme in untrusted JSON. That input reaches new URI(value) and then Path.of(uri), which falls back to ServiceLoader<FileSystemProvider> resolution and can invoke a matching provider’s getPath(uri) during deserialization. The result is unintended provider loading and provider-driven path handling inside the application, which can trigger denial of service or other side effects depending on what FileSystemProvider implementations are present on the classpath.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.6, 3.2.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the MapMessage.asJson() method, which emits the bare NaN, Infinity, or -Infinity tokens instead of an RFC 8259-compliant representation. An attacker can emit malformed JSON that corrupts the enclosing log record or disrupts downstream log ingestion and parsing by supplying non-finite floating-point values that the application records in a logged MapMessage. Exploitation requires the application to use the message resolver of JsonTemplateLayout, or another layout relying on MapMessage.asJson(), and to log a MapMessage holding attacker-controlled floating-point values.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-34481.

Remediation

A fix was pushed into the master branch but not yet published.

References

• event-template-resolver-message Documentation
• GitHub Commit
• GitHub PR
• Vulnerability Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to HTTP Response Splitting via the Content-Disposition header when untrusted input is used to construct its value. An attacker can inject malicious characters to break the HTTP header or corrupt the framing of an outbound multipart body by supplying specially crafted file names or values.

Note: This is only exploitable if the application uses non-default or legacy HTTP connectors that do not reject malicious characters in header values, or if untrusted input is used to set the Content-Disposition of a part in an outbound multipart request body.

Remediation

Upgrade org.springframework:spring-web to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.data:spring-data-jpa is a package that is used to implement JPA based repositories.

Affected versions of this package are vulnerable to SQL Injection in the validation of Sort parameters when crafted payloads are accepted from untrusted sources and used without prior sanitization in native SQL repository methods. An attacker can infer data characteristics or cause limited information disclosure and disruption by supplying specially crafted non-ASCII input to endpoints that accept sorting parameters and use them in native queries.

Note: This is only exploitable if the repository method is annotated with @NativeQuery or @Query(nativeQuery=true), accepts Sort or Pageable parameters, and the underlying database allows non-ASCII characters in SQL syntax.

Remediation

Upgrade org.springframework.data:spring-data-jpa to version 4.0.7, 4.1.1 or higher.

References

• Spring Security Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control checks by supplying the IPv4 or IPv6 "any local" addresses (0.0.0.0 or ::), which are incorrectly classified as external rather than internal. This is only exploitable if the application uses InetAddressMatchers.matchInternal() or InetAddressMatchers.matchExternal() and relies on their classification to make access control decisions for 0.0.0.0 or ::.

Remediation

Upgrade org.springframework.security:spring-security-core to version 7.1.1 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType() method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable base. An attacker can trigger instantiation of arbitrary classes that implement Comparable, such as java.io.File to reach path-traversal primitives, by sending JSON with attacker-controlled type identifiers. This requires the application to use a bare @JsonTypeInfo with the default validator and no explicit PolymorphicTypeValidator, and a property or class whose declared base type is Comparable.

Workaround

This vulnerability can be avoided by configuring an explicit restrictive PolymorphicTypeValidator, such as a BasicPolymorphicTypeValidator allowlist passed to activateDefaultTyping(), instead of relying on the default validator.

Note: The discoverer of this vulnerability reports that "I have not identified a class implementing Comparable that yields code execution purely through deserialization".

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.6, 3.2.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when sending view fragments over Server-Sent Events (SSE). An attacker can cause data streams to be corrupted and potentially inject malicious information to other users by controlling the data that is streamed to clients.

Note: This is only exploitable if the application uses Spring MVC or Spring WebFlux, sends view fragments via SSE, and the attacker can control the streamed data.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective web.xml when special roles and empty authorization constraints are present. An attacker can bypass intended access restrictions by exploiting the absence of these constraints in the logged configuration.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

• Apache Mailing List
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Improper Authorization due to the improper enforcement of security constraints in the default servlet when certain HTTP methods or method omissions are configured. An attacker can gain unauthorized access to protected resources by sending requests using HTTP methods that are not properly restricted.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.119, 10.1.56, 11.0.23 or higher.

References

• Apache Mailing List
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• Apache Tomcat Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect in the UrlHandlerFilter process when it is configured with very broadly matching patterns. An attacker can redirect users to arbitrary external sites by crafting a specially constructed URL.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the BeanDeserializer._deserializeUsingPropertyBased method, whose property-buffering branch omits the prop.visibleInView(activeView) check that the creator-property branch performs. An attacker can populate view-restricted setterless collection or map properties, such as admin-only fields, from untrusted JSON by supplying values for them during deserialization, bypassing @JsonView protection. This affects only setterless collection or map properties annotated with a restricted @JsonView and reached through the property-based creator path.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method, which replays buffered JSON into creator parameters without consulting prop.visibleInView(activeView). An attacker can set view-restricted constructor parameters annotated with both @JsonView and @JsonUnwrapped, such as admin-only fields, from untrusted JSON by supplying them during deserialization while a more restrictive view is active, defeating the @JsonView write-side authorization boundary.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect in the UrlFileNameViewController file when it is mapped with an end-of-path and lacks a configured prefix. An attacker can redirect users to arbitrary external URLs by crafting a specially constructed request.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

LGPL-2.1 license

LGPL-3.0 license

Dual license: EPL-1.0, LGPL-2.1