CLEANSTART-2026-QF25549 In an untrusted JMS environment, org

Security vulnerability affects the apache-nifi package. In an untrusted JMS environment, org...

CLEANSTART-2026-DC52993 Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack

Security vulnerability affects the apache-nifi package. Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack...

CLEANSTART-2026-YI69310 fix for CVE-2026-41409 was not applied to the 2

Security vulnerability affects the apache-nifi package. The fix for CVE-2026-41409 was not applied to the 2...

CLEANSTART-2026-QE04836 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...

CLEANSTART-2026-VJ67556 Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPaylo...

Security vulnerability affects the apache-nifi package. Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted...

CLEANSTART-2026-BK96216 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...

CLEANSTART-2026-CX77611 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS)

Security vulnerability affects the apache-nifi package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS...

CLEANSTART-2026-BV52304 Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the follo...

Security vulnerability affects the apache-nifi package. Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: matchString...

CLEANSTART-2026-GC79065 Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests

Security vulnerability affects the apache-nifi package. Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests...

CLEANSTART-2026-PG68728 Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters

Security vulnerability affects the apache-nifi package. Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters...

CLEANSTART-2026-BI57203 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

CLEANSTART-2026-XE09130 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...

Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...

CLEANSTART-2026-LX92179 Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payl...

Security vulnerability affects the apache-nifi package. Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a...

CLEANSTART-2026-GO33321 Apache MINA's AbstractIoBuffer

Security vulnerability affects the apache-nifi package. Apache MINA's AbstractIoBuffer...

CLEANSTART-2026-DA93625 fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer

Security vulnerability affects the apache-nifi package. The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer...

CLEANSTART-2026-RR80761 attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters

Security vulnerability affects the apache-nifi package. An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

CLEANSTART-2026-SR72438 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2

Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...

CLEANSTART-2026-KI11233 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

Security vulnerability affects the apache-nifi package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

CLEANSTART-2026-UE75885 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-MN19419 Information exposure vulnerability has been identified in Apache Kafka

Security vulnerability affects the apache-nifi package. Information exposure vulnerability has been identified in Apache Kafka...