org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

CVE-2026-89407 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS

NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the same character...

org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...

org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...

bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...

Security Bulletin: IBM Transformation Extender Advanced is affected by multiple Java vulnerabilities.

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is affected by multiple vulnerabilities because it is dependent on Java. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...

tree-sitter-stack-graphs (>=0.3.0, <=0.6.0), tree-sitter-stack-graphs-java (>=0.0.1, <=0.2.0) +4 more potentially affected by unknown CVE via stack-graphs (>=0.10.2, <=0.14.1)

stack-graphs CARGO version =0.10.2, =0.3.0, =0.0.1, =0.0.1, =0.2.0 - tree-sitter-stack-graphs-python 0.0.1 - tree-sitter-stack-graphs-ruby 0.0.1 - tree-sitter-stack-graphs-typescript 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0303...

tree-sitter-stack-graphs (>=0.3.0, <=0.6.0), tree-sitter-stack-graphs-java (>=0.0.1, <=0.2.0) +4 more potentially affected by unknown CVE via stack-graphs (>=0.10.2, <=0.14.1)

stack-graphs CARGO version =0.10.2, =0.3.0, =0.0.1, =0.0.1, =0.2.0 - tree-sitter-stack-graphs-python 0.0.1 - tree-sitter-stack-graphs-ruby 0.0.1 - tree-sitter-stack-graphs-typescript 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0302...

ROOT-APP-MAVEN-CVE-2026-40983 CVE-2026-40983 in io.micrometer:micrometer-core - Patched by Root

Root has patched CVE-2026-40983 in the io.micrometer:micrometer-core package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerabilities in IBM SDK, Java Technology (CVE-2026-16440, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589) affect Power PowerVM Novalink

Summary The IBM SDK, Java Technology used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

PT-2026-97046

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1.0 Description An authenticated non-guest user can execute arbitrary code via Java deserialization at the '/invoker/' HTTP invoker endpoint. The issue occurs because the class-name denylist enforced by...

Oracle Critical Patch Update Advisory - July 2026

This Critical Patch Update contains 19 new security patches, plus additional third party patches noted below, for Oracle Java SE. 17 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. CVE-2026-6257...