GHSA-675F-RQ2R-JW82 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

Impact The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key...

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

Impact The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

CVE-2025-22149

The CVE-2025-22149 issue affects the JWK Set Go implementation’s auto-caching HTTP client (github.com/MicahParks/jwkset). Before v0.6.0, the local JWK Set cache could overwrite or append during remote refresh instead of performing a full replacement, potentially leaving revoked keys usable if rem...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

CVE-2025-22149

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

CVE-2025-22149: Operation on a Resource after Expiration or Release

JWK Set JSON Web Key Set is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use...

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal fr...

UBUNTU-CVE-2024-56521

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely...

Async Http Client RequestBuilder CookieStore Unauthorized Access

The vulnerability of the RequestBuilder class in the CookieStore interface of the asynchronous HTTP request processing library Async Http Client is related to the replacement of cookie files due to incorrect authentication procedures. Exploiting this vulnerability can allow an attacker operating...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

com.arpnetworking.metrics:mad-experimental (1.2.3), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.22.2, <=1.22.4) +30 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.0)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =1.22.2, =1.13.6, =0.0.9, =1.3.13, =1.3.13, =1.3.13, =0.1.0, =0.0.2, =0.0.1-alpha, =0.3.1, =0.3.4 and more Source cves: CVE-2024-53990 Source advisory: GHSA-MFJ5-CF8G-G2FV...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2363 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: GHSA-MFJ5-CF8G-G2FV...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2363 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...

com.arpnetworking.metrics:mad-experimental (1.2.3), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.22.2, <=1.22.4) +30 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.0)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =1.22.2, =1.13.6, =0.0.9, =1.3.13, =1.3.13, =1.3.13, =0.1.0, =0.0.2, =0.0.1-alpha, =0.3.1, =0.3.4 and more Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...

UBUNTU-CVE-2024-53990

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

com.arpnetworking.metrics:mad-experimental (1.2.3), com.arpnetworking.metrics:metrics-aggregator-daemon (>=1.22.2, <=1.22.4) +30 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.0)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =1.22.2, =1.13.6, =0.0.9, =1.3.13, =1.3.13, =1.3.13, =0.1.0, =0.0.2, =0.0.1-alpha, =0.3.1, =0.3.4 and more Source cves: CVE-2024-53990 Source advisory: MEND:CVE-2024-53990...

ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6), app.peac:core (0.0.1) +2363 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=2.1.0, <=2.12.3)

org.asynchttpclient:async-http-client MAVEN version =2.1.0, =1.7, =4.1.0, =4.0.0-beta.2, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.9.2 and more Source cves: CVE-2024-53990 Source advisory: MEND:CVE-2024-53990...

Async Http Client Authorization Vulnerability

Async Http Client is AsyncHttpClient open source asynchronous Http and WebSocket client library for Java. An authorization issue vulnerability exists in Async Http Client version 3.0.0, which stems from an automatically enabled and self-managed CookieStore handling mechanism that can lead to...