Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...

Use Of A Broken Or Risky Cryptographic Algorithm

Spring Security is vulnerable to Use of a Broken or Risky Cryptographic Algorithm. The vulnerability is due to AesBytesEncryptor using AES/CBC with a null all-zero initialization vector, which allows an attacker to exploit predictable encryption and potentially infer relationships between encrypt...

Arbitrary File Write

org.springframework.integration, spring-integration-zip is vulnerable to arbitrary file write. The vulnerability is due to improper validation of the filename header when processing messages with ZipResultType.FILE, which allows an attacker to specify an arbitrary filesystem path and cause the...

CLSA-2026-1788547257 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.11-tuxcare.4...

CLSA-2026-1788547255 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.4...

CLSA-2026-1788536930 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 26 org.springframework packages to address 1 CVE. Fixed in 6.1.4-tuxcare.5...

CLSA-2026-1788534182 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.12-tuxcare.4...

opentaint go-server/latest

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

CLSA-2026-1788528946 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.7-tuxcare.6...

CLSA-2026-1788527138 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 6.0.23-tuxcare.9...

CLSA-2026-1788526262 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.13-tuxcare.4...

CLSA-2026-1788525613 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.16-tuxcare.8...

CLSA-2026-1788525419 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.0-tuxcare.3...

spring-ai-sibling-loop-poc

Spring AI PDF Reader — sibling self-loop PoC incomplete fix of CVE-2026-47851 Minimal reproduction for an infinite loop / OOM in org.springframework.ai.reader.pdf.config.ParagraphManager of org.springframework.ai:spring-ai-pdf-document-reader. Reported as a private GitHub Security Advisory to...

Denial-of-Service (DoS)

org.springframework.amqp, spring-amqp is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of compressed messages during message decompression, which allows an attacker who can publish a specially crafted 1 MB message to a queue consumed by an application with...

Uncontrolled Memory Allocation

Spring Integration is vulnerable to uncontrolled memory allocation. The vulnerability is due to the deserializer trusting the sender-supplied octet count and allocating a byte array of the specified size without an upper limit, which allows an attacker to send a maliciously large frame length and...

Optimistic Locking/version Validation Bypass

Spring Data REST is vulnerable to improper handling of the persisted @Version property during HTTP PUT requests against immutable target types. The vulnerability is due to Spring Data REST failing to preserve the persisted version value of an aggregate root when processing a PUT request, which...

CLSA-2026-1788508154 TuxCare security update for org.springframework.pulsar (1 CVE)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 1 CVE. Fixed in 1.2.13-tuxcare.4...

CLSA-2026-1788508031 TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.17-tuxcare.5...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper handling of the WebSocket client keepAlive feature, where the client maintains persistent connections without adequate limits and an attacker can trigger excessive resource consumption to cause a denial of...