22 matches found
com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.85.0) potentially affected by CVE-2026-11751 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.40.0)
com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.85.0 Source cves: CVE-2026-11751 Source advisory: SNYK:JAVA-COMLINECORPARMERIA-18958665...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
EUVD-2026-62218
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751
The armeria-xds library (versions prior to 1.41.0 ) silently disables TLS peer verification for xDS-managed upstream connections, enabling man-in-the-middle attacks with network-level access. CVSS 4.0 scores this CRITICAL (9.1). Exploitation details are not provided; upgrade to armeria-xds 1.41.0...
com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.85.0) potentially affected by CVE-2026-11751 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.40.0)
com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.85.0 Source cves: CVE-2026-11751 Source advisory: MEND:CVE-2026-11751...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751: Undefined Security Weakness
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
PT-2026-78255
Name of the Vulnerable Software and Affected Versions armeria-xds versions prior to 1.41.0 Description An issue exists where xDS upstream TLS peer verification may be silently disabled. This allows man-in-the-middle attacks against upstream connections managed by xDS. TLS Transport Layer Security...
com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.81.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.37.0, <=1.39.0)
com.linecorp.armeria:armeria-xds MAVEN version =1.37.0, =0.81.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: SNYK:JAVA-COMLINECORPARMERIA-17391817...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path in DataSourceStream, which resolves control-plane-supplied DataSourceStream resolves the filename and environmentvariable fields without restriction. An attacker in a MitM position can access...
CVE-2026-11752
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local...
CVE-2026-11752
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local...
CVE-2026-11752
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local...
CVE-2026-11752
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local...
com.linecorp.centraldogma:centraldogma-client-java-armeria-xds (>=0.69.0, <=0.83.0) potentially affected by CVE-2026-11752 via com.linecorp.armeria:armeria-xds (>=1.30.0, <=1.39.0)
com.linecorp.armeria:armeria-xds MAVEN version =1.30.0, =0.69.0, =0.83.0 Source cves: CVE-2026-11752 Source advisory: MEND:CVE-2026-11752...
CVE-2026-11752
Armeria-xds versions 1.38.0–1.39.0 contain a vulnerability in DataSourceStream where control-plane-supplied filenames and environment_variable fields from SDS secrets are resolved without any allow-list or base-directory confinement. A semi-trusted or compromised xDS control plane (or an attacker...
CVE-2026-11752: Undefined Security Weakness
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local...