CLEANSTART-2026-RW83573 Denial of Service in JSON-Java versions up to and including 20230618

CVE-2023-5072 affects multiple packages. Denial of Service in JSON-Java versions up to and including 20230618. See references for individual vulnerability details...

CLEANSTART-2026-JZ37836 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler)

CVE-2024-21098 affects multiple packages. Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Compiler. See references for individual vulnerability details...

CLEANSTART-2026-QW98383 Undici is an HTTP/1

Security vulnerability affects the openjdk21 package. Undici is an HTTP/1...

CLEANSTART-2026-US99887 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21011 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-ZC34581 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)

CVE-2024-20952 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. See references for individual vulnerability details...

CLEANSTART-2026-LT49444 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21068 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-NO86926 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-20918 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-PN59834 On Linux, Node

CVE-2024-21892 affects multiple packages. On Linux, Node. See references for individual vulnerability details...

CLEANSTART-2026-YP18578 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21094 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-BM42059 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the openjdk21 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-TJ26770 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler)

CVE-2024-21211 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Compiler. See references for individual vulnerability details...

CLEANSTART-2026-QE66223 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21131 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-JW62412 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21235 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-XP47213 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21140 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-HE50427 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)

CVE-2025-50106 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. See references for individual vulnerability details...

CLEANSTART-2026-JD76322 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)

CVE-2024-21208 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. See references for individual vulnerability details...

CLEANSTART-2026-CA29673 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)

CVE-2024-21145 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. See references for individual vulnerability details...

CLEANSTART-2026-VZ07098 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization)

CVE-2024-21217 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. See references for individual vulnerability details...

CLEANSTART-2026-BM84201 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

CVE-2024-21147 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...

CLEANSTART-2026-TY39541 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting)

CVE-2025-30761 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. See references for individual vulnerability details...

CLEANSTART-2026-MA15395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)

CVE-2025-53066 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. See references for individual vulnerability details...

CLEANSTART-2026-KV92980 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)

CVE-2025-30749 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. See references for individual vulnerability details...

CLEANSTART-2026-LQ63526 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

CVE-2025-61748 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. See references for individual vulnerability details...

CLEANSTART-2026-YV55708 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

Security vulnerability affects the wave package. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

CLEANSTART-2026-PU34028 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-RA51574 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

Security vulnerability affects the wave package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...

CLEANSTART-2026-GY77159 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-AO15558 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-ZY41765 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-QI90513 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-IX85296 When http

CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...

CLEANSTART-2026-QG19683 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-UU45005 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-OF55498 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Security vulnerability affects the wave package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...

CLEANSTART-2026-IQ56937 libjpeg 9c has a large loop because read_pixel in rdtarga

Security vulnerability affects the libjpeg-turbo package. libjpeg 9c has a large loop because readpixel in rdtarga...

CLEANSTART-2026-BY32153 libjpeg-turbo 2

Security vulnerability affects the libjpeg-turbo package. libjpeg-turbo 2...

CLEANSTART-2026-CV08695 tjLoadImage function in libjpeg-turbo 2

Security vulnerability affects the libjpeg-turbo package. The tjLoadImage function in libjpeg-turbo 2...

CLEANSTART-2026-EG09226 libjpeg-turbo 1

Security vulnerability affects the libjpeg-turbo package. libjpeg-turbo 1...

CLEANSTART-2026-ET03360 In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon

Security vulnerability affects the libjpeg-turbo package. In generatejsimdyccrgbconvertneon of jsimdarm64neon...

CLEANSTART-2026-AW54211 crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo

Security vulnerability affects the libjpeg-turbo package. A crafted input file could cause a null pointer dereference in jcopysamplerows when processed by libjpeg-turbo...

CLEANSTART-2026-GF49451 libjpeg-turbo 2

Security vulnerability affects the libjpeg-turbo package. libjpeg-turbo 2...

CLEANSTART-2026-EW60545 heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext

Security vulnerability affects the libjpeg-turbo package. A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2mergedupsampleinternal function of jdmrgext...

CLEANSTART-2026-YE92089 Libjpeg-turbo versions 2

Security vulnerability affects the libjpeg-turbo package. Libjpeg-turbo versions 2...

CLEANSTART-2026-VP40557 snappy-java through 1

Security vulnerability affects the solr package. snappy-java through 1...

CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-DC31578 `github

Security vulnerability affects the gosu package. The github...

CLEANSTART-2026-XV24797 snappy-java through 1

Security vulnerability affects the solr package. snappy-java through 1...

CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...