Maven security incidents — recent advisories and exploits

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

Protobuf Java vulnerable to Uncontrolled Resource Consumption

com.google.protobuf:protobuf-java: 3.0.0 → 3.16.3

3 years ago

HIGHMaven

Protobuf Java vulnerable to Uncontrolled Resource Consumption

com.google.protobuf:protobuf-java: 3.0.0 → 3.16.3

3 years ago

Maven incidents

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

PowSyBl Core has Command Injection in LocalCommandExecutor-s

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

Spinnaker: Improper yaml processing on kustomize bake operations

MapFish Print has XXE that allows reading arbitrary files of certain types

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Yamcs has DOM XSS in Extension Routing

Yamcs has Unauthenticated Directory Traversal

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

http4s has HTTP/2 Denial of Service with Ember Backend

IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Sakai Profile Image Deletion has an IDOR

Sakai Conversations has a Stored XSS Issue

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

RabbitMQ Java client malformed body frame triggers raw command assembler exception

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Netty: Memory Exhaustion in SctpMessageCompletionHandler

OpenAM Insecure SSO Cookie Initialization

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Apache Ranger has a Command Injection vulnerability

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

jsoup: Cleaner may expose markup with custom raw-text elements

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

core-geonetwork has an Open Redirect Bypass

veraPDF Validation XXE via Rich Text

veraPDF Parser DoS via PostScript CMap Streams

veraPDF Parser DoS via PostScript Type 1 Font Programs

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

veraPDF Validation XXE via XFA

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

ArcadeDB has cross-database IDOR: /ts/, /batch/, Prometheus and Grafana handlers bypass authorization