RHLW-2026-B13520FAC3AB7893 Lightwell Security Advisory: opentelemetry-api 1.25.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.25.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.25...

RHLW-2026-70779BC964A31A7E Lightwell Security Advisory: netty-resolver-dns 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-resolver-dns 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-45673, CVE-2026-45674, and CVE-2026-47691. CVE-2026-45673: Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port CVE-2026-45674: Netty Vulnerable to D...

RHLW-2026-6E6E3B76EDF3A10B Lightwell Security Advisory: mina-core 2.2.5.rhlw-00009

Red Hat Lightwell has released org.apache.mina:mina-core 2.2.5.rhlw-00009 with a backported security fix. CVE-2026-47065: Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 This patched artifact is a drop-in replacement for org.apache.mina:mina-core 2.2.5 fr...

RHLW-2026-0A6FC4430620D7B4 Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00002

Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00002 with a backported security fix. CVE-2023-52428: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration count for the...

RHLW-2026-7B68982493D0DCE4 Lightwell Security Advisory: jackson-datatype-jsr310 2.8.11.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.8.11.rhlw-00001 with a backported security fix. CVE-2018-1000873: Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in...

RHLW-2026-2D8697B26CCD16C3 Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481. CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider CVE-2026-63687:...

RHLW-2026-FD244C7EA4E4E9E4 Lightwell Security Advisory: cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 3.6.9.rhlw-00003 with backported fixes for CVE-2026-50623, CVE-2026-50627, CVE-2026-50628, CVE-2026-50629, CVE-2026-50630, CVE-2026-50631, CVE-2026-57818, CVE-2026-61466, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481...

RHLW-2026-9FA472B9239A3A7E Lightwell Security Advisory: avro-compiler 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro-compiler 1.9.2.rhlw-00002 with a backported security fix. CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code This patched artifact is a drop-in replacement for org.apache.avro:avro-compiler 1.9.2 from Maven Central...

RHLW-2026-B2C0EE9CF7434158 Lightwell Security Advisory: assertj-core 3.24.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.24.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-6F1A404174E2316F Lightwell Security Advisory: netty-codec-redis 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-redis 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42586, CVE-2026-44250, CVE-2026-44890, CVE-2026-48006, CVE-2026-50011, and CVE-2026-56818. CVE-2026-42586: Netty: CRLF Injection in Netty Redis Codec Encoder CVE-2026-44250: Netty...

RHLW-2026-2E889FEB45FC9875 Lightwell Security Advisory: netty-codec-haproxy 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-haproxy 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44893, CVE-2026-48059, CVE-2026-55851, and CVE-2026-59919. CVE-2026-44893: Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length CVE-2026-48059: Netty HAProx...

RHLW-2026-48B9709BA25473BE Lightwell Security Advisory: netty-codec-mqtt 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-mqtt 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-44248: Netty: Resource exhaustion in MqttDecoder This patched artifact is a drop-in replacement for io.netty:netty-codec-mqtt 4.1.100.Final from Maven Central...

RHLW-2026-4F7C55B876854238 Lightwell Security Advisory: fontbox 2.0.19.rhlw-00001

Red Hat Lightwell has released org.apache.pdfbox:fontbox 2.0.19.rhlw-00001 with a backported security fix. CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. This patched...

RHLW-2026-689BBA11EAE91BCB Lightwell Security Advisory: cxf-jaxrs-service 3.6.9.rhlw-00004

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909. CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE CVE-2026-50632: Apache...

RHLW-2026-9BD677F780E42D38 Lightwell Security Advisory: classgraph 4.8.36.rhlw-00001

Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.36.rhlw-00001 with a backported security fix. CVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity XXE attacks. This patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.3...

RHLW-2026-2F27E699C38D33D5 Lightwell Security Advisory: neethi 3.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.neethi:neethi 3.2.2.rhlw-00006 with backported fixes for CVE-2026-66142, CVE-2026-66143, and CVE-2026-66144. CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing CVE-2026-66143: Apache Neethi: Missing global alternative-output budget...

RHLW-2026-91A888529DD87FBC Lightwell Security Advisory: gson 2.8.6.rhlw-00002

Red Hat Lightwell has released com.google.code.gson:gson 2.8.6.rhlw-00002 with a backported security fix. CVE-2022-25647: Deserialization of Untrusted Data This patched artifact is a drop-in replacement for com.google.code.gson:gson 2.8.6 from Maven Central...

RHLW-2026-685154D7989C42E9 Lightwell Security Advisory: commons-compress 1.9.0.rhlw-00005

Red Hat Lightwell has released org.apache.commons:commons-compress 1.9.0.rhlw-00005 with backported fixes for CVE-2018-11771, CVE-2021-35515, CVE-2021-35517, CVE-2021-36090, and CVE-2024-25710. CVE-2018-11771: When reading a specially crafted ZIP archive, the read method of Apache Commons Compres...

RHLW-2026-C317E2781FF17B2F Lightwell Security Advisory: jetty-http 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty:jetty-http 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for org.eclipse.jetty:jetty-http 12.0.32 from Maven Centr...

RHLW-2026-0436667CEE7724A6 Lightwell Security Advisory: apache-mime4j-dom 0.8.9.rhlw-00004

Red Hat Lightwell has released org.apache.james:apache-mime4j-dom 0.8.9.rhlw-00004 with a backported security fix. CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add...

RHLW-2026-F06E820781099AD6 Lightwell Security Advisory: assertj-core 3.27.4.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.27.4.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-EE4B4A9CCFE02127 Lightwell Security Advisory: zookeeper 3.5.8.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.5.8.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.5.8 from Mav...

RHLW-2026-B7941F01D48EB65E Lightwell Security Advisory: assertj-core 3.25.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 3.25.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-68F6300FE5CDDF04 Lightwell Security Advisory: assertj-core 3.27.6.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.27.6.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-8EF16DDAA2E22182 Lightwell Security Advisory: spring-webflux 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-webflux 5.3.18.rhlw-00010 with backported fixes for CVE-2024-38816, CVE-2024-38819, CVE-2026-22735, CVE-2026-22737, CVE-2026-22740, CVE-2026-22741, CVE-2026-22745, CVE-2026-41839, CVE-2026-41840, CVE-2026-41841, CVE-2026-41842,...

RHLW-2026-8279A9B7F6BB0BE6 Lightwell Security Advisory: spring-messaging 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-messaging 5.3.18.rhlw-00010 with a backported security fix. CVE-2022-22971: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of...

RHLW-2026-6B59708C7ADB9EB8 Lightwell Security Advisory: spring 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring 5.3.18.rhlw-00010 with a backported security fix. CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in...

RHLW-2026-847D178EF0F52697 Lightwell Security Advisory: spring-boot-devtools 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-devtools 2.7.18.rhlw-00004 with a backported security fix. CVE-2026-40972: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extre...

RHLW-2026-7E27D228834C9346 Lightwell Security Advisory: netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-handler-ssl-ocsp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56820, CVE-2026-56821, and CVE-2026-56822. CVE-2026-56820: Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVE-2026-56821: Netty: Out-of-date...

RHLW-2026-99869C1CAD4574FC Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-5583...

RHLW-2026-44A75016EAB78E73 Lightwell Security Advisory: commons-fileupload 1.4.0.rhlw-00001

Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.4.0.rhlw-00001 with backported fixes for CVE-2023-24998 and CVE-2025-48976. CVE-2023-24998: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts CVE-2025-48976: Apache Commons FileUpload, Apache Common...

RHLW-2026-BE2F564B0BEE4A36 Lightwell Security Advisory: commons-beanutils 1.9.4.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.9.4.rhlw-00001 with a backported security fix. CVE-2025-48734: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using t...

RHLW-2026-A4C4A4BF58E29184 Lightwell Security Advisory: json-path 2.7.0.rhlw-00001

Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.7.0.rhlw-00001 with a backported security fix. CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse method. This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path...

RHLW-2026-BF51D193D76DE6EF Lightwell Security Advisory: xmlunit-assertj3 2.9.1.rhlw-00002

Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.9.1.rhlw-00002 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension...

RHLW-2026-A06FD4CFDAB7EF70 Lightwell Security Advisory: spring-aop 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-aop 5.3.18.rhlw-00010 with a backported security fix. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data. Depending on how t...

RHLW-2026-779E7AA7BC83A4C5 Lightwell Security Advisory: spring-security-aspects 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-aspects 5.7.11.rhlw-00006 with a backported security fix. This patched artifact is a drop-in replacement for org.springframework.security:spring-security-aspects 5.7.11 from Maven Central...

RHLW-2026-37913C8C5F4BDEA1 Lightwell Security Advisory: jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for...

RHLW-2026-BEB8398E1777D04E Lightwell Security Advisory: assertj-guava 3.27.3.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-guava 3.27.3.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-0A09F6ECF7835EA0 Lightwell Security Advisory: assertj-guava 3.25.1.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-guava 3.25.1.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-06C890C70B401B52 Lightwell Security Advisory: assertj-core 3.4.1.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.4.1.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-BFCCEA342DD4B844 Lightwell Security Advisory: assertj-core 3.23.1.rhlw-00002

Red Hat Lightwell has released org.assertj:assertj-core 3.23.1.rhlw-00002 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-69E0A9B52C08198F Lightwell Security Advisory: assertj-core 3.1.0.rhlw-00003

Red Hat Lightwell has released org.assertj:assertj-core 3.1.0.rhlw-00003 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-C0819A53DD258DB2 Lightwell Security Advisory: assertj-core 2.6.0.rhlw-00001

Red Hat Lightwell has released org.assertj:assertj-core 2.6.0.rhlw-00001 with a backported security fix. CVE-2026-24400: AssertJ has XML External Entity XXE vulnerability when parsing untrusted XML via isXmlEqualTo assertion This patched artifact is a drop-in replacement for...

RHLW-2026-0D09FAEDDB529ACC Lightwell Security Advisory: zookeeper-jute 3.5.9.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.5.9.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute 3.5....

RHLW-2026-09AD7CE59E9C497A Lightwell Security Advisory: zookeeper-jute 3.4.14.rhlw-00001

Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.4.14.rhlw-00001 with a backported security fix. CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute...

RHLW-2026-4051AB209E8865E6 Lightwell Security Advisory: avro-android 1.11.0.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro-android 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561. CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution...

RHLW-2026-93C3DAF552B9D6BC Lightwell Security Advisory: commons-net 2.0.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 2.0.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-BCAF0A0AE0978229 Lightwell Security Advisory: jackson-databind 2.13.4.2-rhlw-00004

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.2-rhlw-00004 with a backported security fix. CVE-2026-91776: jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID This patched artifact is a drop-in...

RHLW-2026-96D3EE80FB77C7D0 Lightwell Security Advisory: logback-classic 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central...

RHLW-2026-B44D1F7DAC7A0D3D Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006

Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198. CVE-2022-31197: SQL Injection in ResultSet.refreshRow with malicious column names in pgjdbc CVE-2022-41946: TemporaryFolder on...