CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718

AsyncHttpClient (AHC) for Java is affected by a connection permit leak in versions 3.0.8 through 3.0.12. When a TLS connection fails before the handshake completes, NettyConnectListener removes the partition key lock permit from NettyResponseFuture before all failure paths are bound to the channe...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721

CVE-2026-85721 affects the AsyncHttpClient (AHC) Java library. The automatic response decompressor on the HTTP/1.1 path (Http1ContentDecompressor) had no cumulative output-size limit, allowing a hostile or compromised server to send a small compressed response that expands across chunks until the...

EUVD-2026-81907

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

EUVD-2026-81905

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

CVE-2026-85717 affects the AsyncHttpClient (AHC) Java library, versions 2.14.5–2.16.0 and 3.0.9–3.0.11 . When a client is configured with a client-wide Realm and redirect following , the Interceptors authentication path falls back to the client configuration after redirect handling clears the per...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85719

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Vulnerability In AMQConnection.java line 435-436, after Connection.Tune negotiation, the frame-max limit is set via: java frameHandler.setFrameMax Math.minthis.maxInboundMessageBodySize, frameMax; When frameMax = 0 meaning "unlimited" per AMQP spec, Math.min67108864, 0 = 0. This value is then...

GHSA-JH4V-GFQJ-7RHX RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Vulnerability In AMQConnection.java line 435-436, after Connection.Tune negotiation, the frame-max limit is set via: java frameHandler.setFrameMax Math.minthis.maxInboundMessageBodySize, frameMax; When frameMax = 0 meaning "unlimited" per AMQP spec, Math.min67108864, 0 = 0. This value is then...

EUVD-2026-80941

RabbitMQ Java client has frame-level OOM: Math.minmaxInboundMessageBodySize, 0 defeats frame size enforcement...

scagoat

SCA Goat Navigating SCA Vulnerabilities, Empowering Mastery...

Security Bulletin: Eclipse parsson security vulnerability in IBM Content Cortex reported for BAI-EVENTS-JAVA-SDK

Summary Eclipse parsson CVE-2026-9563 security vulnerability in IBM Content Cortex. Affected and vulnerable. Vulnerability Details CVEID:CVE-2026-9563 DESCRIPTION: In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the...

ROOT-APP-MAVEN-CVE-2022-41946 CVE-2022-41946 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2022-41946 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application

Summary There are multiple security vulnerability in IBM Maximo Asset Management application Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in...