CVE-2025-55182

了解 React Server Components 与 Flight 协议 React Server Components 是 React 19 中引入的一项功能，允许组件在服务器端渲染，而非在客户端浏览器中渲染。服务器可以处理复杂的计算任务，同时只将渲染后的结果发送给客户端。 RSC 中服务器与客户端之间的通信基于 React Flight 协议。该协议处理服务器与客户端之间传输数据的序列化与反序列化。当客户端需要调用服务器端函数（Server Action）时，它会发送一个包含已序列化数据的特殊格式请求，供服务器进行反序列化并处理。 Flight...

spring4shell-local-verification-lab

Spring4Shell ローカル影響条件の検証・修正・再テストプロジェクト プロジェクト概要 本プロジェクトは、Spring Framework CVE-2022-22965、すなわち Spring4Shell 脆弱性の影響条件、リスクの顕在化、修正方法、修正後の再テスト手順を学習・検証するためのものです。 プロジェクトは個人が構築したローカルの許可環境で実施しました。プロジェクトの重点は実際の標的への攻撃ではなく、修正前・修正後の Spring MVC テスト環境を構築し、脆弱性に関する影響条件を項目ごとに確認し、安全かつ制御可能な読み取り専用の方法で、Spring...

Linux Distros Unpatched Vulnerability : CVE-2026-59282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a...

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

UBUNTU-CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

K000163049: Spring Data Commons vulnerability CVE-2026-41695

Security Advisory Description Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 3 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-41695 DESCRIPTION: Spring Data Commons applications may be vulnerable to denial of service through resource...

Prototype Pollution

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Prototype Pollution in the contextBridge boundary. An attacker can influence the prototype of objects copied across the...

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation Algorithmic DoS Impact When a consuming module routes user-supplied dot-paths sort parameters, projection paths, PATCH paths through...

GHSA-88FW-V6X4-3F58 Spring Data: Unbounded property-path cache keyed by externally-supplied path string

src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation Algorithmic DoS Impact When a consuming module routes user-supplied dot-paths sort parameters, projection paths, PATCH paths through...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the lookup function when handling HTTP/2 requests. An attacker can cause the application to crash by sending specially crafted HTTP method values that exploit inherited object properties, leading to a denial of...

Prototype Pollution

Overview compromise is a natural language processing in the browser. Affected versions of this package are vulnerable to Prototype Pollution via the nlp.extend function in the Public Root API. An attacker can modify object prototype attributes by supplying a crafted plugin argument, potentially...

CVE-2026-41695

A flaw was found in Spring Data Commons. A remote attacker can exploit this vulnerability by providing specially crafted property path strings to the MappingContext property path resolution. This can lead to resource exhaustion, resulting in a denial of service DoS for affected applications...

Prototype Pollution

Overview scim-patch is a SCIM Patch operation rfc7644. Affected versions of this package are vulnerable to Prototype Pollution via the scimPatch function. An attacker can modify the Object.prototype by supplying specially crafted keys in a patch operation, which can lead to privilege escalation,...

Prototype Pollution

Overview piscina is an A fast, efficient Node.js Worker Thread Pool implementation Affected versions of this package are vulnerable to Prototype Pollution via the options.filename property in the constructor and run function. An attacker can execute arbitrary code and gain control over worker...

GHSA-MWPV-RG79-863C Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41695: Uncontrolled Resource Consumption

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...