Find, fix and prevent vulnerabilities in your code.

Overview

org.apache.httpcomponents.client5:httpclient5 is a HttpClient component of the Apache HttpComponents project.

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the ContentCompressionExec response decoding path in httpclient5/src/main/java/org/apache/hc/client5/http/impl/classic/ContentCompressionExec.java. An attacker can exhaust the connection pool by sending a response with an invalid or unsupported Content-Encoding header that causes decoding to fail. When the classic I/O client raises the exception, it leaves the underlying response stream and connection unreleased, so pooled connections remain tied up and subsequent requests stall or fail.

Remediation

Upgrade org.apache.httpcomponents.client5:httpclient5 to version 5.6.3 or higher.

References

• Apache Security Advisory
• GitHub Commit
• GitHub Commit
• OSS Security Advisory

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with ClassWriter.COMPUTE_FRAMES; their methods make frame computation’s fixpoint algorithm converge slowly.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

• GitLab Commit
• gitlab.ow2.org
• gitlab.ow2.org
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames() and computeMaxStackAndLocal() methods in MethodWriter. When ASM processes a crafted class file with thousands of overlapping exception handlers using COMPUTE_FRAMES or COMPUTE_MAXS, it allocates excessive Edge objects, causing an OutOfMemoryError that crashes the JVM.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

• GitLab Commit
• gitlab.ow2.org
• gitlab.ow2.org
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via readBootstrapMethodsAttribute() in ClassReader. When an application parses an attacker-supplied class file, a crafted BootstrapMethods attribute with an unchecked declared length can trigger an allocation of roughly 2 GB from a file of about 100 bytes, causing an OutOfMemoryError that crashes the JVM or the thread processing the class.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

• GitLab Commit
• gitlab.ow2.org
• gitlab.ow2.org
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the addSubroutineRetSuccessors() method in the Label class. An attacker can crash the JVM by supplying a crafted invalid class file with multiple RET instructions for one JSR while ASM processes the subroutine.

Notes

• The attacker must get a user to load or process the crafted class file.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

• GitLab Commit
• gitlab.ow2.org
• gitlab.ow2.org
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the parseType method in SignatureReader. An attacker can trigger a StackOverflowError and disrupt class transformation by supplying a crafted class file with a Signature attribute containing deeply nested generic type arguments.

Remediation

Upgrade org.ow2.asm:asm to version 9.11 or higher.

References

• GitLab Commit
• gitlab.ow2.org
• gitlab.ow2.org
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the MapMessage.asJson() method, which emits the bare NaN, Infinity, or -Infinity tokens instead of an RFC 8259-compliant representation. An attacker can emit malformed JSON that corrupts the enclosing log record or disrupts downstream log ingestion and parsing by supplying non-finite floating-point values that the application records in a logged MapMessage. Exploitation requires the application to use the message resolver of JsonTemplateLayout, or another layout relying on MapMessage.asJson(), and to log a MapMessage holding attacker-controlled floating-point values.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-34481.

Remediation

A fix was pushed into the master branch but not yet published.

References

• event-template-resolver-message Documentation
• GitHub Commit
• GitHub PR
• Vulnerability Advisory

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component. An attacker can intercept or redirect log traffic by performing a man-in-the-middle attack if they are able to intercept or redirect network traffic between the client and the log receiver and can present a server certificate issued by a certification authority trusted by the configured trust store or the default Java trust store.

Workaround

This vulnerability can be mitigated by configuring the SocketAppender to use a private or restricted trust root to limit the set of trusted certificates.

Remediation

Upgrade org.apache.logging.log4j:log4j-core to version 2.25.3 or higher.

References

• Apache Advisory
• Apache Documentation
• Apache Documentation
• Apache Thread
• GitHub Commit
• GitHub PR

Overview

org.apache.logging.log4j:log4j-core is a logging library for Java.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component when configured through the verifyHostName attribute of the <Ssl> element. An attacker can intercept and manipulate network traffic by presenting a certificate issued by a trusted certificate authority to the appender's configured trust store, or the default Java trust store if none is configured. This is only exploitable if an SMTP, Socket, or Syslog appender is in use and TLS is configured via a nested element.

Note:

This issue is due to incomplete fix for CVE-2025-68161.

Remediation

A fix was pushed into the master branch but not yet published.

References

• Apache Mailing List
• Apache Security Advisory
• GitHub Commit
• GitHub Issue

LGPL-2.1 license

LGPL-2.1 license

MPL-2.0 license