EUVD-2026-78085

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

CVE-2026-90819

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access to critical data due to Java SDK

Summary An exploitable vulnerability in Java allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allo...

CVE-2026-50270

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-86318

A flaw was found in java-json-tools json-patch. A remote attacker could exploit a stack-based buffer overflow vulnerability in the JsonMergePatch.fromJson function by sending specially crafted JSON input. This could lead to a denial of service, making the affected system unavailable. Mitigation...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to IBM Semeru runtime

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Semeru Runtime and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

CVE-2026-73494

blaze is a Scala library for asynchronous network I/O pipelines. Five HTTP/1.1 conformance laxities in its hand-written Java parser (http/src/main/java/org/http4s/blaze/http/parser/) accept malformed requests—invalid tchar header names, obs-fold lines, unsupported Transfer-Encoding values, duplic...

CVE-2026-53752 docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

CVE-2026-12860

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270 dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

EUVD-2026-77670

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50270

dd-trace-java (Datadog APM client for Java) versions prior to 1.62.0 are vulnerable to a remote Denial of Service due to improper parsing of W3C baggage headers. The extraction path in BaggagePropagator.java allocates a hash-map entry for each comma-separated key-value pair without enforcing DD_T...

OESA-2026-3836 openjdk-25 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2;...

OESA-2026-3835 openjdk-25 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2;...

OESA-2026-3818 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer ASan, the program leaks memory in various locations, eventually leading to high memory usage and causi...