lazylist-cve-poc

CVE-2022-36944 payload generator This mini-project is created to demonstrate proof of concept of CVE-2022-36944 vulnerability. It is similar to ysoserial, but generates payload only for this CVE with LazyList class. Quick FAQ What artifacts bring the vulnerability? org.scala-lang:scala-library wi...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

ROOT-APP-MAVEN-CVE-2022-36944 CVE-2022-36944 in io.root.org.scala-lang:scala-library - Patched by Root

Root has patched CVE-2022-36944 in the io.root.org.scala-lang:scala-library package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8

Summary Third party reported 'Stored XSS' and 'CSRF' issues, Apache Tomcat, Apache ActiveMQ, CKEditor, libcURL, xmlbeans, scala-library, json-smart, jna-platform, jackson-databind, commons-io, shiro-core, commons-net, snappy-java, xercesImpl are identified as vulnerable components with multiple...

Deserialization Of Untrusted Data

scala-library is vulnerable to deserialization of untrusted data. The vulnerability exists because the readObject function in the LazyList.scala allows an attacker to erase the contents of arbitrary files, make network connections, or possibly run arbitrary code on Function0 via a gadget chain...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Design/Logic Flaw

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...