160 matches found
Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...
ROOT-APP-MAVEN-CVE-2026-54428 CVE-2026-54428 in org.apache.httpcomponents.core5:httpcore5-h2 - Patched by Root
Root has patched CVE-2026-54428 in the org.apache.httpcomponents.core5:httpcore5-h2 package for Root:Maven. Multiple fixed versions available...
CLEANSTART-2026-MM56894 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5
Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...
Security Bulletin: Multiple Security Vulnerabilities in Apache HttpComponents Client affect IBM Content Navigator
Summary Apache HttpComponents Client is affected by two vulnerabilities CVSS up to 9.1, Critical. CVE-2026-71290 CVSS 9.1 is an improper TLS hostname verification flaw in the async HttpClient versions 5.4 and later where HostnameVerificationPolicyBUILTIN has no effect, allowing a network attacker...
Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities
Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION:...
Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection
Summary HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the...
org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...
Security Bulletin: Due to the use of Apache HttpComponents Client 5.4, IBM Sterling Control Center is vulnerable to Improper Certificate Validation (CVE-2026-71290)
Summary Apache HttpComponents Client 5.4 is used by IBM Sterling Control Center as part of dependency in httpclient5-5.4.3.jar. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer...
Security Bulletin: Denial of Service Security Vulnerability in Apache HttpComponents Core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-54428)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-54428 DESCRIPTION: Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5.4.2 and earlier,...
CLSA-2026-1789474443 TuxCare security update for org.apache.httpcomponents.client5 (1 CVE)
TuxCare rebuilt 6 org.apache.httpcomponents.client5 packages to address 1 CVE. Fixed in 5.0.3-tuxcare.1...
CLSA-2026-1789467085 TuxCare security update for org.apache.httpcomponents.core5 (1 CVE)
TuxCare rebuilt 5 org.apache.httpcomponents.core5 packages to address 1 CVE. Fixed in 5.1.3-tuxcare.1...
Improper Certificate Validation
Apache HttpComponents Client is vulnerable to Improper Certificate Validation. The vulnerability is due to the HostnameVerificationPolicyBUILTIN setting being ineffective in the asynchronous HttpClient, which allows an attacker capable of intercepting and modifying traffic to impersonate the...
CLEANSTART-2026-OB74177 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5
Multiple security vulnerabilities affect the spring-boot package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...
CLEANSTART-2026-EC45528 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5
Multiple security vulnerabilities affect the apache-nifi package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows...
CLSA-2026-1788763778 TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)
TuxCare rebuilt 5 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.5-tuxcare.1...
org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification
A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...
Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available RHBQ 3.33.3.SP1.The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.Red Hat Product...
org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...
CVE-2026-64607
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...