Every CVE we've remediated.

ActiveMQ Artemis federation instantiates arbitrary classes named by a peer

RabbitMQ management UI login cookie holds the username and password in base64

RabbitMQ OAuth 2 backend ignores the HTTP status of JWKS responses, so an error response wipes the signing keys

RabbitMQ management UI exposes the OAuth 2 client secret through an unauthenticated JavaScript file

Stored XSS in the RabbitMQ stream management UI through a TLS client certificate DN

RabbitMQ management UI writes bearer tokens unescaped into the OAuth bootstrap JavaScript

RabbitMQ stream management lets a low-privilege user force large allocations through super stream binding keys

RabbitMQ topic bindings with repeated # segments cause combinatorial routing work

RabbitMQ OAuth 2 plugin skips TLS verification of the JWKS endpoint when no CA bundle is available

RabbitMQ trust store plugin accepts forged client certificates that match a whitelisted issuer and serial

RabbitMQ AMQP 1.0 parser can be crashed before authentication with a 19-byte frame

RabbitMQ Web MQTT plugin inflates compressed WebSocket frames without a size limit

RabbitMQ management API reflects any Origin with credentials when CORS is set to a wildcard

Stored XSS in the RabbitMQ management UI connection page through a TLS client certificate subject

Authenticated AMQP clients can exhaust the RabbitMQ atom table through reply-to queue names

RabbitMQ AMQP 0-9-1 body size is not checked until the message is complete

Apache Tomcat: security constraints for WebSocket endpoints can be bypassed

Apache Tomcat: CLIENT_CERT authentication does not fail when OCSP soft fail is disabled

Apache Tomcat: HTTP/2 request header mix-up from a regression in the CVE-2026-41293 fix

Apache Tomcat Native: insecure OpenSSL options enabled by default

Apache Tomcat: stale HPACK emitter injects trailers into another HTTP/2 request

Apache Tomcat: denial of service via busy wait during WebSocket close

Apache Tomcat: AJP denial of service via missing request body

Apache Tomcat: WebSocket denial of service from lost asynchronous write timeouts

Apache Tomcat: WebSocket message smuggling with per-message-deflate

Apache Tomcat Native: denial of service via TLS handshake

Apache Tomcat Native: client certificate requirements can be downgraded

Apache Tomcat: cross-context authentication mix-up with Jakarta Authentication

Apache Tomcat: HTTP/2 denial of service via malformed request

Erlang/OTP TLS 1.3 client skips server authentication when the ServerHello carries an unsolicited PSK

Erlang/OTP asn1 OBJECT IDENTIFIER decoder takes quadratic time on crafted input during TLS handshakes

Erlang/OTP ssh daemon memory exhaustion through session channels that never get a handler

rabbitmq-c heap overflow from an undersized frame_max during login

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check.

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.

`deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions,…

RabbitMQ amqp091-go client keeps parsing from the wrong offset after an oversized longstr

RabbitMQ amqp091-go client does not set a minimum TLS version for amqps connections

RabbitMQ amqp091-go client silently truncates message properties longer than 255 bytes

RabbitMQ amqp091-go client accepts a FrameMax below the AMQP minimum

RabbitMQ amqp091-go client preallocates message bodies from an unchecked declared size

RabbitMQ amqp091-go client panics on a negative byte-array length from the broker

RabbitMQ amqp091-go client writes TLS file paths into amqps URIs without encoding

RabbitMQ Java client loses its inbound message size cap when frameMax is zero

RabbitMQ amqp091-go client wraps negative prefetch values into very large limits

RabbitMQ amqp091-go client stalls when an application notification channel is not drained

RabbitMQ amqp091-go client keeps the PLAIN password in the connection config for the connection's lifetime

Apache NiFi: missing authorization for components referenced in flow update methods

Apache NiFi: Content-Encoding case and repetition bypass the gzip request block

Apache NiFi Registry: path manipulation when storing extension bundles

Apache Storm: nimbus.groups ignored when nimbus.users is empty

Apache Storm: unauthenticated memory exhaustion in the worker messaging decoder

Apache Storm DRPC: unauthenticated unbounded memory growth

Apache Storm Nimbus: cross-tenant blob deletion and loss of leadership through dependency keys

Apache Storm: cross-tenant dependency jar substitution through predictable blob keys

Apache Storm Nimbus: blobstore authorization bypass through rebalance overrides

Apache Storm: authenticated UI, Logviewer and DRPC responses readable from other origins

Apache Storm: path traversal as the supervisor user through blobstore map local names

Apache Storm worker-launcher: local privilege escalation to root through a time-of-check race

Apache Storm worker-launcher: root through Docker and OCI command files handed to the tenant

Apache Storm Nimbus: arbitrary file read through an unvalidated uploaded jar location

Apache Storm: unredacted daemon configuration through Nimbus and the UI

Apache Storm: topology ZooKeeper credential disclosed to read-only users and logs

Apache Storm: unredacted merged daemon configuration through the topology page

Apache Storm Logviewer: log access controls not enforced for daemon logs

Apache Artemis CORE protocol session reattachment lets an unauthenticated attacker take over a session

Apache Artemis exposes cluster credentials to discovered peers before authentication

Apache Artemis OpenWire RemoveSubscriptionInfo can delete a queue before authentication

Apache Artemis CORE protocol handler lets unauthenticated clients create durable queues

Apache Artemis discloses cluster topology to unauthenticated CORE clients

Apache Artemis: management-via-messaging parameter deserialization can pin a broker thread

Apache Artemis: crafted wildcard selector ties up a shared broker thread

Consul: catalog node-write authorization bypass allows node identity takeover

Consul: Connect intentions authorization bypass from unescaped characters in Envoy RBAC rules

Consul: native RPC listener memory exhaustion before ACL checks

Apache ActiveMQ lets an authenticated client spoof the clientId when removing a durable topic subscription

MongoDB Server: case handling in configuration validation can leave authorization disabled

Erlang/OTP inets httpd workers are never released after a malformed chunk-size line

Erlang/OTP inets httpd accepts unlimited connections when max_clients is not set explicitly

Erlang/OTP inets httpd workers wait forever on a request body that stops short of its Content-Length

Erlang/OTP inet driver {packet,4} length overflow writes past the receive buffer

Erlang/OTP inets httpd mod_auth bypass with a doubled slash

Erlang/OTP inets httpd mod_auth bypass through letter case on case-insensitive filesystems

Erlang/OTP httpc client accepts unbounded response headers

Erlang/OTP inets httpd ignores the body size limit for chunked requests

Erlang/OTP inets httpd request smuggling through whitespace before the header colon

Erlang/OTP inets httpd request smuggling through obs-fold header continuation lines

Erlang/OTP inets httpd accepts requests with both Transfer-Encoding and Content-Length

Elasticsearch: remote code execution through deserialization of a crafted trained model

Elasticsearch: HTTP request smuggling can return other users' responses

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application…

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent…

Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not…

WebFlux application using functional endpoints and deployed with DispatcherServlet may be…

Spring MVC applications using the functional web framework are vulnerable to stream corruption…

Applications that evaluate Spring Expression Language (SpEL) expressions using…

Spring Security: embedded UnboundID LDAP server exposes a well-known admin bind DN on all interfaces

Spring Security Authorization Server: dynamic client registration accepts crafted client metadata

Spring Security WebAuthn: user verification skipped with a distributed session store

Spring Security: AesBytesEncryptor in CBC mode uses an all-zero IV

Apache Tomcat: security constraint bypass with overlapping path constraints

Apache Tomcat: principal lookup fails open in DataSourceRealm and JDBCRealm

Apache Tomcat: RewriteValve [N] flag restarts at the second rule

Apache Tomcat: HTTP/2 denial of service via allocation leak on stream reset

Spring Security: DPoP proof replay after forced cache eviction

Apache Hive: SQL injection in metastore direct SQL partition-name lookups

Apache Hive: SSRF through avro.schema.url in the Avro SerDe

Apache Hive: forged SAML bearer token gives a HiveServer2 session as any user

Apache Camel: platform-http-main JWT authentication skips issuer and audience checks

Apache Camel: camel-mail MimeMultipart data format copies MIME headers without filtering

PostgreSQL: type confusion through "internal" arguments executes arbitrary code

PostgreSQL: type confusion in the cursor and portal lifecycle executes arbitrary code

PostgreSQL: SQL injection through EXTRACT() expression deparse

PostgreSQL: pg_dump heap buffer overflow on long function transform lists

Elasticsearch: out-of-range pointer offset in the machine learning native inference process

Elasticsearch: simulate pipeline request causes unbounded recursion and kills the node

etcd: TLS listener spawns unbounded handshake goroutines with no deadline

etcd: Watch API authorization bypass through open-ended range requests

MongoDB Server: intra-cluster authentication mechanism can be influenced, exposing the internal credential

.NET: use after free in Microsoft QUIC discloses memory

Consul: unbounded connections to the external gRPC listeners allow unauthenticated denial of service

Consul: partial arbitrary file read through the Vault Connect CA provider with JWT or AppRole auth

Consul: agent HTTP endpoints process unbounded request bodies before authorization

Consul: Connect CA roots endpoint ignores the cache-disable setting

Node.js: retained HTTP/2 headers bypass maxSessionMemory

Node.js: HTTP/2 re-entrant send causes heap use-after-free

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does…

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with…

Apache NiFi: uncontrolled resource consumption through decompression of HTTP requests

Apache NiFi: incorrect authorization for Parameter Context validation requests

Node.js: permission model path matching over-grants file system access

Apache ActiveMQ AMQP NIO connector threads die on a crafted frame size

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an…

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules),…

Erlang/OTP TLS 1.2 and DTLS clients accept an anonymous cipher suite they never offered

Erlang/OTP certificate policy tree grows exponentially during path validation

Erlang/OTP crashes on a TLS certificate chain of two mutually cross-signed certificates

Erlang/OTP megaco flex scanner buffer overflow from an oversized property name

Apache HBase: Thrift and REST gateways do not check scanner ownership

.NET: EncryptedXml signature verification flaw allows security feature bypass

ASP.NET Core Negotiate authentication: improper parsing allows elevation of privilege

ASP.NET Core Negotiate authentication: incorrect validation with LDAP roles allows elevation of privilege

.NET SslStream: authorization checks can be bypassed on TLS connections

RabbitMQ direct reply-to bindings persist after unbind and allow reply-channel injection

RabbitMQ management HTTP API accepts request bodies larger than the configured limit

RabbitMQ GET /api/auth discloses the OAuth 2 client secret without authentication

RabbitMQ stream listener ignores its frame size limit before authentication

RabbitMQ topic authorization allows restricted writes when a Khepri lookup fails

memberlist, embedded in Consul: crafted gossip push/pull message exhausts memory

etcd: client certificate revocation list not enforced on the gRPC listener

Apache Camel: camel-keycloak accepts any bearer token when no roles or permissions are required

Apache Camel: JMS deserialization filter bypass through DefaultExchangeHolder

Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried…

Elasticsearch: crafted bulk request causes sustained high CPU

Apache ActiveMQ lets low-privilege web console users reach the admin pages by default

Apache ActiveMQ STOMP connector denial of service through a negative content-length

Apache ActiveMQ pre-authentication OpenWire memory allocation during wire format negotiation

Apache ActiveMQ unbounded memory allocation when unmarshalling OpenWire message properties

Apache ActiveMQ temporary destinations can be consumed by another connection

Apache Tomcat: authentication bypass with JNDIRealm and a GSSAPI authenticated bind

Node.js: WebCrypto AES integer overflow crashes the process

Apache NiFi: restricted permissions not enforced when replacing flow contents

Apache NiFi: improper escaping of table names in CaptureChangeMySQL

Apache NiFi: missing validation of proxy host headers

Apache NiFi: incorrect authorization for configuration verification requests

MongoDB Server: use after free in server-side JavaScript BSON-to-array conversion

Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an…

Spring Security: SubjectDnX509PrincipalExtractor misreads malformed certificate CNs

Spring Security SAML 2.0: REDIRECT binding inflates compressed payloads without a limit

Spring Security SAML 2.0: asserting party credentials deserialized from the database without a filter

MongoDB Server: unbounded recursion in BSON validation lets an unauthenticated client crash mongod

ASP.NET Core SignalR and Blazor Server: deeply nested MessagePack arrays cause denial of service

Apache Kafka: CONSUMER_GROUP_DESCRIBE authorization differs from the documentation

Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

Apache ActiveMQ remote code execution through Jolokia addNetworkConnector

Apache Artemis: STOMP user can change an address's routing type without createAddress

Apache Ignite: REST API cmd=log path traversal reads any file

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and…

RabbitMQ MQTT topic authorization bypass through regex injection in the client ID

Apache Flink Kubernetes Operator: unvalidated FlinkSessionJob jarURI allows SSRF and file reads

Apache Camel: CXF and Knative endpoints do not filter inbound Camel headers

Apache Flink: code injection in SQL code generation runs code on TaskManagers

PostgreSQL: integer wraparound makes the server undersize allocations

PostgreSQL: libpq large object functions let a server superuser overwrite client stack memory

PostgreSQL: uncontrolled recursion in SSL and GSS negotiation causes denial of service

etcd: PrevKv and lease attachment in transactional Put bypass RBAC

MongoDB Server: out-of-bounds write in time-series collections with duplicate field names

Apache Tomcat: DIGEST authenticator authenticates unknown users who send the password "null"

Apache Tomcat: security constraints not correctly applied for repeated extension patterns

Apache Tomcat: unbounded request body read in WebDAV LOCK and PROPFIND

optional extension component TinkerpopClientService is missing the Restricted annotation with…

Redis is an in-memory data structure store.

Redis is an in-memory data structure store.

Redis is an in-memory data structure store.

Spring Boot: default web security can be ineffective, allowing unauthorized access to all endpoints

Spring Boot: Cassandra auto-configuration does not verify the server hostname over SSL

Spring Boot DevTools: timing attack on the remote secret

Spring Boot: ${random.value} values are not suitable for use as secrets

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in…

fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant…

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms,…

Apache Camel: camel-mail consumers map Camel headers from inbound mail

Apache Camel: unsafe Java deserialization in the camel-consul ConsulRegistry

Apache Camel: unsafe deserialization in the camel-mina ObjectInput converter

Spring Boot: RabbitMQ auto-configuration with an SSL bundle does not verify the broker hostname

Apache Storm: TLS client authentication failure assigns an anonymous principal

Apache Storm: Prometheus reporter skip_tls_validation disables certificate checks JVM-wide

Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

Spring Security: SubjectX500PrincipalExtractor misreads malformed certificate CNs

Spring Security: securityMatchers(String) with a servlet path prefix can leave a filter chain unapplied

ASP.NET Core Data Protection: forged authentication cookies and payload decryption

possible security vulnerability has been identified in Apache Kafka.

Apache Kafka Clients: NetworkClient DEBUG logging exposes credentials

Apache Storm: Kerberos TGT credential deserialized without a class filter

Apache Storm UI: stored cross-site scripting through topology metadata

Apache ActiveMQ NIO SSL transports run out of memory on repeated TLS 1.3 KeyUpdate messages

Apache Tomcat: padding oracle in the EncryptInterceptor

Apache Tomcat: EncryptInterceptor bypass introduced by the CVE-2026-29146 fix

Apache Tomcat: OCSP checks sometimes soft-fail when soft fail is disabled

Apache Tomcat: request smuggling through invalid chunk extensions

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated…

Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…

race condition in the Apache Kafka Java producer client’s buffer pool management can cause…

Erlang/OTP accepts a forged OCSP designated responder certificate

Node.js: __proto__ header name crashes servers that read req.headersDistinct

etcd: unauthorized calls to MemberList, Alarm, Lease APIs and compaction

etcd: nested transactions bypass RBAC authorization

Apache Artemis: OpenWire non-durable subscription creates an address without createAddress

Spring Boot Actuator: authentication bypass for endpoints under the Cloud Foundry actuator path

Spring Boot Actuator: authentication bypass for endpoints under a health group additional path

Spring Security: HTTP security headers may not be written in servlet applications

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang…

Consul: arbitrary file read through the Vault Connect CA provider's Kubernetes auth token_path

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all…

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP…

Apache Artemis: unauthenticated Core client can force an outbound federation connection to a rogue broker

Apache Camel: unsafe deserialization in the camel-leveldb aggregation repository

Apache NiFi: restricted permissions not enforced for component updates

Apache Tomcat: client certificate verification bypass through virtual host mapping

Apache Tomcat: incomplete OCSP verification with Tomcat Native and the FFM connector

PostgreSQL: missing multibyte character length validation allows code execution

MongoDB Server: pre-authentication memory exhaustion

Apache Druid: LDAP authentication bypass through anonymous bind

Apache Hadoop HDFS native client: out-of-bounds write in the URI parser

Apache Solr: some predefined permission rules in the RuleBasedAuthorizationPlugin can be bypassed

Apache Solr: create core API does not fully enforce allowPaths

Node.js: permission model bypass using crafted symlinks

Node.js: malformed HTTP/2 HEADERS frame crashes the process

Node.js: stack overflow errors become uncatchable with async_hooks

Node.js: Buffer.alloc can return memory that is not zero-filled

Node.js: exceptions in TLS PSK, ALPN and SNI callbacks crash the server

Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires…

MongoDB Server: unauthenticated heap memory read through zlib-compressed message headers (MongoBleed)

Elasticsearch: low-privileged user can crash a node with oversized user settings

Elasticsearch PKI realm: user impersonation through crafted client certificates

Apache Hive: SQL injection in metastore delete column statistics requests

Apache Druid: Kerberos authenticator falls back to a weak cookie signing secret

Redis is an open source, in-memory database that persists on disk.

Consul: KV endpoint denial of service through incorrect Content-Length validation

Consul: event endpoint denial of service through unbounded Content-Length

Apache Tomcat: relative path traversal via rewrite rules

Apache Geode: CSRF through GET requests to the Management and Monitoring REST API

ASP.NET Core Kestrel: HTTP request smuggling allows security feature bypass

Apache Geode: reflected cross-site scripting in the REST web API

Elasticsearch: audit logging can record reindex request bodies containing sensitive data

Apache Flink CDC: SQL injection through crafted database or table names

Redis is an open source, in-memory database that persists on disk.

Redis Lua library commands allow an integer overflow that may lead to remote code execution

Spring Security: method security annotations in generic type hierarchies may not be found

PostgreSQL: pg_dump lets a superuser of the origin server inject code that runs at restore

Apache Tomcat: HTTP/2 denial of service through client-triggered stream resets (MadeYouReset)

Node.js: Windows device names bypass path traversal protection

Node.js 24: HashDoS reintroduced by V8 string hashing change

Redis HyperLogLog commands allow an out-of-bounds write

Redis unauthenticated connections can starve other clients with repeated protocol errors

RabbitMQ logs the HTTP Basic Auth header, exposing usernames and passwords

possible security vulnerability has been identified in Apache Kafka.

possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client.

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule…

Spring Security: method security annotations on private methods not enforced in AspectJ mode

Node.js: error handling in async cryptographic operations crashes the process

Apache ActiveMQ OpenWire unmarshalling allocates memory from an unchecked buffer size

Elasticsearch: crafted search templates with Mustache functions crash the node

Apache Tomcat: denial of service through invalid HTTP priority headers

Spring Boot: EndpointRequest.to() creates a matcher for null/** when the endpoint is not exposed

Redis output buffers grow without limit for an unauthenticated client

Erlang/OTP is a set of libraries for the Erlang programming language.

ActiveMQ Artemis: broker property values, passwords included, written to the debug log

Apache Pulsar IO Kafka connectors log Kafka credentials in plain text

MongoDB Server: intermediate certificates not checked for revocation on Linux

ActiveMQ Artemis: queue-creation permission lets a user change an address's routing type

RabbitMQ management UI renders an unescaped virtual host name in an error message

Spring Security: BCryptPasswordEncoder accepts passwords over 72 characters that share the first 72

Apache Druid: management proxy open to SSRF, XSS and open redirect

ClickHouse: code execution through the library bridge

Apache Camel: header injection through HTTP request parameters

Apache NiFi: MongoDB password can be written to a provenance record

Apache Tomcat: remote code execution via partial PUT on a write-enabled default servlet

Apache Camel: header injection through the default incoming header filter

Apache Ignite: class serialization filters ignored on some endpoints, allowing remote code execution

PostgreSQL: libpq quoting functions allow SQL injection through invalidly encoded text

Apache Hive: credentials file created with world-readable permissions

Apache Hive: timing attack against LLAP message signatures

Apache Solr: core creation with a trusted configset can pick up untrusted files