GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-21933 DESCRIPTION: Java SE could allow a remote attacker to bypass security controls and perform unauthorized update, insert, delete, or read operations on...

MINI-22XJ-7W64-CQGC

Bulletin has no description...

CLSA-2026-1779756518 TuxCare security update for org.apache.commons:commons-compress (2 CVEs)

TuxCare rebuilt org.apache.commons:commons-compress to address 2 CVEs. Fixed in 1.21-tuxcare.1...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service (DoS) flaw (CVE-2024-26308, CVE-2024-25710)

Summary IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service DoS flaw. All those libraries have been upgraded and this issue has been addressed in this release. Vulnerability Details CVEID:CVE-2024-26308...

javapackages-tools:201801 security update

ant-contrib 1.0-0.32.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 1.0-0.31.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora27MassRebuild 1.0-0.30.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora26MassRebuild 1.0-0.29.b3 - Rebuilt for...

SUSE SLED15: apache-commons-compress / apache-commons-lang3 / beust-jcommander / etc (SUSE-SU-2026:3390-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3390-1 advisory. apache-commons-lang3 was updated to 3.20.0: New features: - Add SystemProperties.getPathString, Supplier - Add...

Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn

This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues: apache-commons-lang3 was updated to 3.20.0: New features: Add SystemProperties.getPathString, Supplier Add JavaVersion.JAVA25 Add JavaVersion.JAVA26 Add SystemUtils.ISJAVA25 Add...

SUSE-SU-2026:3390-1 Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn

This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues: apache-commons-lang3 was updated to 3.20.0: New features: + Add SystemProperties.getPathString, Supplier + Add JavaVersion.JAVA25 + Add JavaVersion.JAVA26 + Add SystemUtils.ISJAVA25 + Add...

EUVD-2026-40847

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets...

SUSE-SU-2026:3225-1 Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni

This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: - CVE-2026-26032: improper pathname limitation in PackagerResolver allows for arbitrary files writes outside of the configured buildRoot directory bsc1271727. Other updates...

Security Bulletin: Code injection, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to code injection, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that...

Oracle Linux 9 : maven:3.9 (ELSA-2026-38500)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38500 advisory. aopalliance 0:1.0-49 - Update javapackages test plan to f42 0:1.0-40 - Rebuilt for https://fedoraproject.org/wiki/Fedora41MassRebuild 0:1.0-39 - Rebuilt for...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in DataView. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when...

Security Bulletin: Due to IBM Storage Scale, IBM Cloud Pak System is affected by multiple vulnerabilities [CVE-2025-48976, CVE-2025-30204, CVE-2025-1137].

Summary Execute privileged command and denial of service vulnerabilities found in IBM Storage Scale previously known as IBM Spectrum Scale affect IBM Cloud Pak System. These vulnerabilities were addressed in IBM Cloud Pak System v2.3.6.1 and IBM Cloud Pak System v2.3.5.1 Vulnerability Details...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...

Deserialization of Untrusted Data

Overview com.mchange:c3p0 is a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process. An attacker can execute arbitra...

Security Bulletin: CVE-2025-48924 – Apache Commons Lang Uncontrolled Recursion DoS (StackOverflowError)

Summary A denial-of-service vulnerability exists in Apache Commons Lang due to uncontrolled recursion. When supplied with a sufficiently long input string, these methods can trigger a StackOverflowError. The vulnerability affects commons-lang:commons-lang versions 2.0–2.6 and...

Security update for apache-commons-configuration2, apache-commons-text

This update for apache-commons-configuration2, apache-commons-text fixes the following issues CVE-2026-45205: uncontrolled recursion leads to StackOverflowError when processing specially crafted configuration files bsc1265299. Changes for apache-commons-configuration2: Upgrade to version 2.15.0:...