EUVD-2026-70485

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-85181

CAT (dianping/cat) through 3.1.0 is vulnerable to session cookie forgery due to using Java String.hashCode as the sole integrity check without a server-side secret key. An attacker can compute valid checksums offline and, by setting the x-forwarded-for header, bypass IP-binding validation to crea...

CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

cbor-java:FuzzDec: Security exception in java.base/java.util.Arrays.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=5332107817975808 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Arrays.hashCode...

jackson-dataformat-xml:XmlDeserializerFuzzer: Security exception in java.base/java.util.AbstractMap.hashCode

Project: https://github.com/FasterXML/jackson-dataformat-xml.git Detailed Report: https://oss-fuzz.com/testcase?key=4711750729793536 Project: jackson-dataformat-xml Fuzzing Engine: libFuzzer Fuzz Target: XmlDeserializerFuzzer Job Type: libfuzzerasanjackson-dataformat-xml Platform Id: linux Crash...

jackson-dataformat-xml:XmlDeserializerFuzzer: Security exception in java.base/java.util.AbstractMap.hashCode

Project: https://github.com/FasterXML/jackson-dataformat-xml.git Detailed Report: https://oss-fuzz.com/testcase?key=6182178846736384 Project: jackson-dataformat-xml Fuzzing Engine: libFuzzer Fuzz Target: XmlDeserializerFuzzer Job Type: libfuzzerasanjackson-dataformat-xml Platform Id: linux Crash...

apache-commons-configuration:YAMLConfigurationReadFuzzer: Security exception in java.base/java.util.AbstractSet.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=4510425285197824 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: YAMLConfigurationReadFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

guava:HashingFuzzer: Security exception in java.base/java.lang.AbstractStringBuilder.<init>

Project: https://github.com/google/guava.git Detailed Report: https://oss-fuzz.com/testcase?key=5708235981586432 Project: guava Fuzzing Engine: libFuzzer Fuzz Target: HashingFuzzer Job Type: libfuzzerasanguava Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

snakeyaml:YamlFuzzer: Security exception in java.base/java.util.AbstractSet.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=5167495132086272 Project: snakeyaml Fuzzing Engine: libFuzzer Fuzz Target: YamlFuzzer Job Type: libfuzzerasansnakeyaml Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.AbstractSet.hashCode...

fastjson2:JsonFuzzer: Uncaught exception in java.base/java.util.ArrayList.hashCodeRange

Detailed Report: https://oss-fuzz.com/testcase?key=4802318213709824 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.ArrayList.hashCodeRange...

fastjson2:JsonFuzzer: Uncaught exception in java.base/java.util.AbstractMap.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=5691916710182912 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.AbstractMap.hashCode...

fastjson2:JsonFuzzer: Uncaught exception in java.base/java.util.AbstractSet.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=6619990638854144 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: java.base/java.util.AbstractSet.hashCode...

CVE-2020-11995

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2021:0019-1)

This update for java-171-ibm fixes the following issues : Update to Java 7.1 Service Refresh 4 Fix Pack 75 bsc1180063, bsc1177943 CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803 - Class Libraries : - Z/OS specific C function...

Moderate: Red Hat Security Advisory: Fuse Management Console 7.1.0 update

Fuse Management Console 7.1.0, which fixes one security issue, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score...

Moderate: Red Hat Security Advisory: jbossweb security update

An update for JBoss Enterprise Application Platform 4.3.0 CP10 that fixes multiple security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores,...