GHSA-358M-FQ53-HP87 akka-cluster-metrics uses Java serialization for cluster metrics

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics...

cc.akkaha:asura-cluster_2.12 (>=0.2.0, <=0.6.0), com.adobe.api.platform.runtime:mesos-actor (>=0.0.8_2.12, <=0.0.33) +42 more potentially affected by CVE-2025-53393 via com.typesafe.akka:akka-cluster-metrics_2.12 (>=2.4.16, <=2.7.0)

com.typesafe.akka:akka-cluster-metrics2.12 MAVEN version =2.4.16, =0.2.0, =0.0.82.12, =3.6.0, =3.3.0, =0.1.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =3.2.0-35 and more Source cves: CVE-2025-53393 Source advisory: SNYK:JAVA-COMTYPESAFEAKKA-10567747...

CVE-2025-53393

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics...

Akka 代码问题漏洞

Akka is an Akka open source expressive SDK and platform for developing, deploying and operating enterprise agent services. A code issue vulnerability exists in Akka 2.10.6 and earlier versions that stems from the use of Java serialization to process cluster metrics...

CVE-2025-53393

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics...

CVE-2025-53393

CVE-2025-53393 affects Akka up to version 2.10.6, where akka-cluster-metrics uses Java serialization for cluster metrics. The root cause is deserialization of serialized objects within the MessageSerializer pathway, which the linked sources describe in SNYK/GHSA notices. The CVE entry provides a ...

CVE-2025-53393

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics...

PT-2025-27331 · Akka · Akka

Name of the Vulnerable Software and Affected Versions: Akka versions through 2.10.6 Description: The issue concerns the use of Java serialization for cluster metrics in the akka-cluster-metrics component. Recommendations: For versions through 2.10.6, consider disabling Java serialization for...

CVE-2025-53393

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics...

Exploit for CVE-2025-1974

IngressNightmare: CVE-2025-1974 - Unauthenticated Remote Code...

undertow: AJP Request closes connection exceeding maxRequestSize

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

undertow: AJP Request closes connection exceeding maxRequestSize

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

The vulnerability of the set_cluster_dirty() function in the fs/f2fs/compress.c module of the F2FS file system support in Linux kernel allows a malicious actor to gain access to protected information or cause service failures.

The vulnerability of the setclusterdirty function in the fs/f2fs/compress.c module of the F2FS file system support in Linux kernel relates to incorrect input validation. Exploiting this vulnerability may allow an attacker to access protected information or cause service failures...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

CVE-2025-23260 involves NVIDIA AIStore’s AIS Operator. The Red Hat and NVIDIA-NS docs describe an issue where a user can gain elevated access to a Kubernetes cluster by abusing the ServiceAccount bound to the ClusterRole, potentially leading to information disclosure. Affected component is the AI...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...